Crestal Network
Crestal Network is building a platform for anyone to create a productive AI agent with The Nation, an ecosystem where agents autonomously generate revenue, manage wallets, launch tokens, and access powerful skills to create value both on-chain and off-chain. The set of contracts in scope are the core "agent creation and update" management contracts. They are upgradeable contracts supporting gasless transactions (erc-4337), plus a few simple functions to accept on-chain ERC20-based payments. The set of contracts in scope are the core "agent creation and update" management contracts. They are upgradeable contracts supporting gasless transactions (erc-4337), plus a few simple functions to accept on-chain ERC20-based payments.
Details
Scope
Contest Results
On what chains are the smart contracts going to be deployed?
Base
If you are integrating tokens, are you allowing only whitelisted tokens to work with the codebase or any complying with the standard? Are they assumed to have certain properties, e.g. be non-reentrant? Are there any types of weird tokens you want to integrate?
Only standard ERC-20 tokens
Are there any limitations on values set by admins (or other roles) in the codebase, including restrictions on array lengths?
Owner account is trusted
Fee collection address is also trusted
ERC-20 (payment) tokens set are trusted
Gaslass caller (forwarding gateway) is trusted
Are there any limitations on values set by admins (or other roles) in protocols you integrate with, including restrictions on array lengths?
No
Is the codebase expected to comply with any specific EIPs?
There is a gasless feature for many functions, that are meant to use EIP712 signatures to stay compliant with Biconomy's MEE-forwarded contract calls.
Are there any off-chain mechanisms involved in the protocol (e.g., keeper bots, arbitrage bots, etc.)? We assume these mechanisms will not misbehave, delay, or go offline unless otherwise specified.
No
What properties/invariants do you want to hold even if breaking them has a low/unknown impact?
No
Please discuss any design choices you made.
Please provide links to previous audits (if any).
N/A
Please list any relevant protocol resources.
This is an overview of what we are doing as a platform: https://x.com/marouen19/status/1876214805926957473
This is a set of slightly outdated docs on how management contracts are being used (ignore the solver terminology) - worker decentralization still applies: https://docs.crestal.network/solvers/worker. Ignore all other pages related to IntentKit or solver or Testnet guide.
Overall direction: https://crestal.network/
Live app on Base using a slightly older version of the contracts: https://nation.fun/
Additional audit information.
No forked contracts. Only external dependencies are standard OZ contracts.
Would like you to look into:
- Upgradeable integrations of contracts (any loopholes for upgrading)
- Any function that accepts payments - any non-standard or exploitable calls
- General function usage of variables - potential passing of unexpected values or getting states stuck at certain values
Total Rewards
Contest Pool
Lead Senior Watson
Judging Pool
Lead Judge
7,000 USDC
5,500 USDC
800 USDC
1,200 USDC
Status
Scope
Start Time
End Time
Judging Rules
