KubeCoin minting audit report by MLabs

Finished 2022-03-15
 Table of Contents

KubeCoin minting audit report by MLabs

Summary 2
Assumptions 2
Analysis 2
Found issues 4
A.01 Previous minting of a similar token 4

1
Summary
MLabs audited the correct minting of the Cardano native asset with policy ID
362706e09f908e1470b90278cb50bcd834b4c2f8d489431a8965ddb8 and name KubeCoin
(4b756265436f696e). Throughout the document, this asset is called the KubeCoin token.

Specifically, it has been successfully checked that only 480 million (480,000,000) tokens have
been minted to date and no more tokens can be minted in the future.

Assumptions
The trustworthiness of the claims made by this report rely on the correct implementation of the
multi-signature language and the Cardano command-line interface by IOG, as well as the
veracity of the data displayed by third-party tools like the API Blockfrost or alternatively the
Cardanoscan blockchain explorer.

Analysis
The minting policy of a Cardano native asset specifying the conditions under which tokens can
be minted or burnt can be defined using multi-signature scripts (also called simple scripts).
Transfer logic and other related functionality is built into the Cardano ledger itself. Therefore, no
Plutus scripts are needed to safely create new assets and interact with them.

The KubeCoin policy ID 362706e09f908e1470b90278cb50bcd834b4c2f8d489431a8965ddb8

corresponds to the hash of the following script:

{
"type": "all",
"scripts":
[
{
"type": "before",
"slot": 52172439
},
{
"type": "sig",
"keyHash": "1e877165fc4734d51e23c4ec4bf9de77faaa56c5994a0fddc7c028fb"
}
]}

This can be checked with the Cardano command-line interface (Cardano CLI) by running the
following command:

2
 > cardano-cli transaction policyid --script-file FILE

where FILE is the filepath of the script.

The minting policy establishes two conditions that must be met in order to allow the minting or
burning of a KubeCoin token:
- The upper bound of the transaction validity interval must be lower than slot 52172439
- The transaction must be signed by the key corresponding to the public key hash
1e877165fc4734d51e23c4ec4bf9de77faaa56c5994a0fddc7c028fb.

The current slot of the Cardano blockchain can be checked by running the following command
in the CLI:

> cardano-cli query tip --mainnet

At the time of writing this report, the current slot number is 55702137, which is already past slot
52172439. This means that no more KubeCoin tokens can be minted or burnt. Therefore, the
total supply of KubeCoin tokens that will ever be in existence can be computed by aggregating
the total number of minted tokens to date and subtracting the amount of tokens burnt.

Querying the blockchain, it can be checked that there is only one transaction minting KubeCoin
tokens and no transactions burning them. The transaction with hash
5c1818cf34ee8d1c46c2e05b72d4decbf3661191ae86883f1585cf035ef8456a, included in
block number 6828911, mints 480,000,000 KubeCoin tokens in slot 52163448 and sends them
to the address addr1v97nmncwc8x4xsyvn8psfqnrwp8ny02jt0zgztvsnqn7a9cscp0tk.

The public key hash of the address

addr1v97nmncwc8x4xsyvn8psfqnrwp8ny02jt0zgztvsnqn7a9cscp0tk used to pay for the
fees and minimum ADA and receive the tokens is
7d3dcf0ec1cd53408c99c3048263704f323d525bc4812d909827ee97, different from the public
key hash mentioned in the minting policy. This poses no problem at all, since the key
corresponding to the public key hash
1e877165fc4734d51e23c4ec4bf9de77faaa56c5994a0fddc7c028fb is only needed as a
witness, i.e. must sign the transaction, with no further requirements.

3
Found issues

A.01 Previous minting of a similar token

Prior to the minting of the KubeCoin tokens, 480 millions (480,000,000) of tokens of a similarly
named asset Kubecoin (4b756265636f696e) with policy ID
3b6f1e831ae8fa6455cd7374208e4ded0fb5e48849b120b2e212a8a2 were minted and sent to
the same wallet addr1v97nmncwc8x4xsyvn8psfqnrwp8ny02jt0zgztvsnqn7a9cscp0tk. The
minting of these tokens (Kubecoin tokens from now on) was performed on slot 52091951 by the
transaction hash
eec3c513d41c4026652e3639d7819a36fdd259a1191e6a569d4b7211b733c75d included in
block 6825509.

The minting policy of the Kubecoin tokens is:

{
"type": "all",
"scripts":
[
{
"type": "before",
"slot": 52100951
},
{
"type": "sig",
"keyHash": "96d44006db70bfa981d54d9aeecfb9d4318816794a005130bb379378"
}
]
}

Since all the minting and burning had to occur before slot 52100951, no more Kubecoin tokens
can be minted or burnt.

The minting of Kubecoin tokens is most likely due to a failed KubeCoin minting attempt and can
be safely ignored. Nonetheless, it must be noted that the similarity of the two tokens (name and
minted amount) plus the fact that both assets have been first received by the same wallet may
lead to confusion, especially among users of blockchain explorers.