ETH_Call_report.md

Summary

This is the report from a security audit performed on Call by MrCrambo.

The audit focused primarily on the security of Call smart contracts.

In scope

1. interfaces/IERC664.sol
2. interfaces/IERC777.sol
3. interfaces/IERC777TokensRecipient.sol
4. interfaces/IERC664TokensSender.sol
5. misc/ERC664Balances.sol
6. misc/SafeGuard.sol
7. test/EIP20.sol
8. test/Test.sol
9. test/TestTokensRecipient.sol
10. test/TestTokensSender.sol
11. token/ERC777.sol
12. token/ERC777ERC20Compat.sol
13. token/ERC777RemoteBridge.sol
14. CALL.sol
15. CStore.sol

Findings

In total, 7 issues were reported including:

• 0 high severity issues.

• 2 medium severity issues.

• 3 owner privilegies issues.

• 2 low severity issues.

• 0 notes.

Security issues

1. Zero address checking

Severity: low

Description

There are no zero address checking in functions setModule, incBalance, decBalance in misc/ERC664Balances.sol contract, in functions transfer and transferFrom in test/EIP20.sol, .

2. Owner privilegies

Severity: owner privilegies

Description

1. Owner can increase and decrease any users balances in misc/ERC664Balances.sol contract.
2. Owner can change balance database in line 32 at CStore.sol contract, that could be risky for investors.
3. Owner can enable and disable ERC20Token.

3. No cap for totalSupply

Severity: medium

Description

Owner can increase totalSupply as much as he wants and it could be risky to investors in misc/ERC664Balances.sol contract.

Recommendation

Add cap that should be equal to max total supply and check, that your current totalSupply is less than this cap.

4. totalSupply less than total tokens amount

Severity: medium

Description

Owner can decrease totalSupply as much, that totalSupply will be less than all tokens hold by users in misc/ERC664Balances.sol contract.

Recommendation

Add checking, that decreased totalSupply will be greater than tokens hold by users.

5. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

Conclusion

Smart contract contains medium severity issues.