This is the report from a security audit performed on LuckyStrikeV3 by MrCrambo.
The audit focused primarily on the security of LuckyStrikeV3 smart contracts.
- https://ropsten.etherscan.io/address/0x78c32ffb7d209457a75e6c25854f19de58d64a4b#code
- https://ropsten.etherscan.io/address/0xfd9f46d87625f1f8ee06fdb7f5e93c745005aae2#code
In total, 6 issues were reported including:
-
0 high severity issues.
-
3 medium severity issues.
-
3 low severity issues.
In function mint
there is possibility of minting more than hardCap
.
Line 331 LuckyStrikeToken
contract.
You should check (invested + _invested) > hardCap
before minting and if it's true, mint only hardCap - invested
number of tokens and return remainder to investor.
- It is possible to double withdrawal attack. More details here
- Lack of transaction handling mechanism issue. More details here
Add into a function transfer(address _to, ... )
following code:
require( _to != address(this) );
The ether sent through init member of LuckyStrike game contract will be lost in the contract since it is not placed in sum array in any way. Depending the amount to be sent the severity can vary from low to medium.
Line 1498 in LuckyStruke
contract.
adjustAllocation
function member of LuckyStrike
allow the owner to reset the rates of the different jackpots and income rate, combined with issue 3.1 the risk for investors can be clear.
Line 1575 in LuckyStruke
contract.
Lucky strike token decimals value is equal to zero, which means that no value after the decimal point is saved. When computing the token to mint for an investor, the fifth of the sent value when calling investAndPlay
function is used to compute the investment and the other part is used to buy tickets, the fifth of the value is divided by tokenPriceInWei
meaning that any value that is not a multiple of tokenPriceInWei
will be truncated and the remaining value given to the marketing fund without compensation.
Line 1782 in LuckyStruke
contract.
-
Knowing that the token price in usd at the moment of writing is 0.0207, the described issue will be expose any user to a loss of value lower than 0.0207 USD and same as described before the gas optimization is not worth it.
-
Since 1/5 of the value sent through
investAndPlay
is used to buy token and 4/5 is used to place a bet, therefor there will be a smaller part of ether that will be lost in the contract or taken without giving token or a fraction of it to back the full investment since0.00015 * 5 != n tokenPriceInWei + ticketPriceInWei
.
- Once the
hardCap
orsalePeriod
reached the sale will be closed and all token minting will stop, therefore if everyone sells its tokens which is a possible case, onlywithdrawAllByOwner
will be able to withdraw all the game contract income meaning that the contract owners will get all the game contract returns.
Line 190 LuckyStrikeToken
contract.
- If
hardCap
is set low enough compared to the 70M tokens distributed initially the contract owners or the four addresses first set by the owner will be guaranteed a minimum return percentage, following the actual contract, the production hard cap will be equal to 4500 ether and the token price will be 0.00015 ether meaning that only 30M tokens will be sold which will guarantee 70% of the contract returns to the four addresses set by the owner.
Line 141 LuckyStrikeToken
contract.
Smart contract contains medium severity issues.