Summary
This is the report from a security audit performed on ZAC Finance by MrCrambo.
The audit focused primarily on the security of ZAC Finance smart contract.
In scope
Findings
In total, 2 issues were reported including:
-
0 high severity issues.
-
0 medium severity issues.
-
0 owner privilegies issues.
-
2 low severity issues.
Security issues
1. Zero address checking
Severity: low severity
Description
There are no zero address checking in functions transfer
and transferFrom
and also total supply will be calculated as the difference between all the tokens and zero address balance.
Recommendation
We recommend to add burn
function for burning extra tokens and to add zero address checking in functions transfer
and transferFrom
.
2. Known vulnerabilities of ERC-20 token
Severity: low severity
Description
-
It is possible to double withdrawal attack. More details here
-
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here
Recommendation
Add into a function transfer(address _to, ... )
following code:
require( _to != address(this) );
Approval
event in transferFrom
function
3. No Severity: recommendation
Description
There is no Approval
event emitted after the transferFrom
function will be executed. But it would be better to call this event, because allowed transfer amount will be changed.
Conclusion
Smart contract contains only low severity issues and could be deployed on mainnet without any threats to investors.