Ribbon Protocol Vault & Points
Zealynx audited Ribbon Protocol's HealthFi vault and points contracts: a tokenized primary healthcare platform that uses health information NFTs as collateral. The 202 nSLOC review identified 7 issues, 3 Medium (unchecked ERC20 transfers, token decimals mishandling, fee-on-transfer accounting) and 4 Low (single-step ownership, signature replay logic, zero address checks, input validation), all acknowledged.
Scope
2 files · 202 SLOCFindings
click any row for the full write-upKey Findings
- Implement safe transfer methods for ERC20 tokens. The vault calls the original
transferfunction on ERC20 tokens without checking the return value, which several non-standard tokens (USDT among them) silently fail on. Five vault paths includingwithdrawfees,claimPointsAdmin, andswapToPaymentCoinAdminare exposed. - Incorrect handling of token decimals. The contract assumes all ERC20 tokens have 18 decimals, hardcoding the assumption into transfer, calculation, and conversion functions. Tokens with fewer decimals would be processed at incorrect amounts, leading to balance discrepancies and operational failures.
- Fee-on-transfer tokens break
swapToPaymentCoinAdminaccounting. The function assumes the transferred amount is received in full, so any fee-on-transfer token causesamountReceivedto be less thanpointToSwap, producing incorrect calculations and accounting drift. - Single-step ownership transfer in
RibbonVaultconstructor. The vault inherits OpenZeppelin'sOwnablewhich transfers ownership in a single step. A typo at deployment would permanently brick everyonlyOwnerfunction with no recovery path.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
