Skip to content

Instantly share code, notes, and snippets.

@MrCrambo
Created May 21, 2019 08:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save MrCrambo/9f263833d316bd3d040296d456c07fdb to your computer and use it in GitHub Desktop.
Save MrCrambo/9f263833d316bd3d040296d456c07fdb to your computer and use it in GitHub Desktop.

Summary

This is the report from a security audit performed on Idex by MrCrambo.

The audit focused primarily on the security of Idex smart contracts.

In scope

  1. https://github.com/AuroraDAO/idex/blob/master/DVIP.sol
  2. https://github.com/AuroraDAO/idex/blob/master/ExchangeWhitelist.sol
  3. https://github.com/AuroraDAO/idex/blob/master/MyToken.sol
  4. https://github.com/AuroraDAO/idex/blob/master/Exchange.sol

Findings

In total, 7 issues were reported including:

  • 0 high severity issues.

  • 0 medium severity issues.

  • 3 owner privilegies issues.

  • 4 low severity issues.

Security issues

1. Zero address checking

Severity: low

Description

There are no zero address checking in transfer, transferFrom, setFeeAccount, setDVIP

2. No approval event

Severity: low

Description

There is no approval event in function approve

3. Not all ERC-20 functions implemented

Severity: low

Description

balanceOf(address tokenOwner), totalSupply() and allowance(address tokenOwner, address spender) functions not realised.

4. Known vulnerabilities of ERC-20 token

Severity: low

Description

  1. It is possible to double withdrawal attack. More details here
  2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

5. Owner privilegies

Severity: owner privilegies

Description

  1. Owner can change feeAccount any time he wants.
  2. Owner can set anyone as admin, and if his private keys will be stolen, then hackers will be able to set as admin anyone.
  3. Whitelisters set by owner will be able to change rate and limit.

Conclusion

Smart contracts contain low severity issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment