ETH_BAT_report.md

Summary

This is the report from a security audit performed on BAT by MrCrambo.

The audit focused primarily on the security of BAT smart contract.

In scope

1. https://gist.github.com/yuriy77k/9f8fcc78745cf81e3aff92da724b3d5c#file-batoken-sol

Findings

In total, 3 issues was reported including:

• 0 critical severity issues.

• 0 high severity issues.

• 1 medium severity issues.

• 2 low severity issues.

1. Wrong event

Severity: medium

Description

In function refund there is event comes before sending tokens at line 171, and if sending will be failed event log will be written to the blockchain.

Recommendation

Add event after tokens sending.

2. No time checking

Severity: low

Description

In constructor there is no checking that _fundingStartBlock is less than _fundingEndBlock, so the dates could be wrong.

3. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

Conclusion

Smart contract contains medium severity issue.