Filecoin GLIF Pools Protocol Audit Report

This technical report presents the findings from an audit conducted on the GLIF Pools protocol, a new leasing protocol for Filecoin Storage Providers. The audit, performed by Chingiz Mardanov and Sergii Kravchenko from April 10 to April 28, 2023, focused on the protocol's underlying code and the InținityPool implementation, which is the first leasing pool built on this protocol. The audit aimed to assess the correctness of the implementation, identify known vulnerabilities specific to smart contract systems, and evaluate the security specifications of the system. The report details the major issues identified during the audit, including critical vulnerabilities and their resolutions. It also outlines the assumptions made during the audit regarding the system's state and the centralization of control by the GLIF team. The findings emphasize the necessity for careful evaluation of any future code changes due to the inherent trust assumptions in the protocol's design.