Audit Comp | Folks Smart Contract Library-logo

Audit Comp | Folks Smart Contract Library

|

Folks Finance is a leading DeFi platform providing innovative tools for lending, borrowing, trading and managing digital assets, all in one place. The Folks Smart Contract Library is a curated, modular collection of audited, reusable smart contracts designed to accelerate development on the Algorand blockchain. The library allows you to focus on your business logic by abstracting away common patterns and security mechanisms.

Algorand
Python

Live

8d: 4h remaining
Primary Pool
$21,000
All Stars Pool
$6,000
Podium Pool
$3,000
Start Date
07 July 2025
End Date
21 July 2025
Rewards Token
USDC
Lines of Code
440
  • Triaged by Immunefi

  • Step-by-step PoC Required

Select the category you'd like to explore

Assets in Scope

Target
Type
Smart Contract - AccessControl - Contract module that allows children to implement role-based access control mechanisms.
Added on
7 July 2025
Target
Type
Smart Contract - Initialisable - Contract that allows children to be initialisable
Added on
7 July 2025
Target
Type
Smart Contract - InitialisableWithCreator - Extension to Initialisable Contract which ensures caller of "initialise" method is contract creator.
Added on
7 July 2025
Target
Type
Smart Contract - Upgradeable - Contract module that allows children to implement scheduled upgrade mechanisms.
Added on
7 July 2025
Target
Type
Smart Contract - RateLimiter - Contract module that allows children to implement rate limiting mechanisms.
Added on
7 July 2025
Target
Type
Smart Contract - UInt64SetLib - Subroutines to mimic the behaviour of a “set” data structure for uint64 values.
Added on
7 July 2025

Impacts in Scope

Build commands, Test commands, and instructions on how to run them:

Follow the setup instructions in the project README.

  • To generate the TEAL code and ARC56 specs for the contracts, run the command: npm run pre-build

  • To build the TS clients to interact with the contracts, run the command: npm run build

  • Start an Algorand localnet with AlgoKit and Docker using: algokit localnet start

  • Run all tests from root directory using: npm run test

  • Or single test file using: PYTHONPATH="./contracts" npx jest <PATH_TO_TEST_FILE>

Where might Security Researchers confuse out-of-scope code to be in-scope?

  • All the smart contracts in “contracts/library/test” are out of scope and only included to facilitate the unit testing.

Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?

  • Ensuring addresses only operate within their assigned privileges. Also checking the logic of the smart contracts is sound.

Which chains and/or networks will the code in scope be deployed to?

  • Algorand

What external dependencies are there?

  • Algorand Python Compiler

What are the most valuable educational resources already available?

Previous Audits

  • Folks Finance Smart Contract Library has no audit report as of 7 July 2025.
Severity
Critical
Title

Unauthorized escalation of privileged roles which deviate from the original permissions

Severity
Critical
Title

Bypass of the address permissions during an upgrade

Severity
Critical
Title

Bypass of the rate limit beyond set parameters

Severity
High
Title

Permanent denial of service of a smart contract functionality

Severity
Medium
Title

Temporary denial of service for more than one block

Severity
Medium
Title

Impacts caused by griefing with no economic damage other than transaction fees where fix requires a change or a pause of a smart contract

Severity
Low
Title

Contract fails to deliver promised returns, but doesn't lose value

Severity
Low
Title

Temporary denial of service (smart contract is made unable to operate for one block, functionality is restored in the next block)

Severity
Insight
Title

Security best practices

Severity
Insight
Title

Code Optimizations and Enhancements

Severity
Insight
Title

Architectural decentralization

Severity
Insight
Title

Documentation Improvements

Out of scope

Default Out of Scope and rules

Smart Contract specific

  • Incorrect data supplied by third party oracles
    • Not to exclude oracle manipulation/flash loan attacks
  • Impacts requiring basic economic and governance attacks (e.g. 51% attack)
  • Lack of liquidity impacts
  • Impacts from Sybil attacks
  • Impacts involving centralization risks

All categories

  • Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
  • Impacts caused by attacks requiring access to leaked keys/credentials
  • Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
  • Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
  • Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
  • Best practice recommendations
  • Feature requests
  • Impacts on test files and configuration files unless stated otherwise in the bug bounty program
  • Impacts requiring phishing or other social engineering attacks against project's employees and/or customers