ETH_Ethplode_report.md

Ethplode Audit Report.

1. Summary

This document is a security audit report performed by RideSolo, where ethplode has been reviewed.

Symbol       : ETHPLO
Name         : ETHplode
Capped supply: 100,000,000
Decimals     : 6 
Standard     : ERC20

2. In scope

• Token.sol github commit hash ef823e10eeb853e669eb4c50b4c1672e019e2a0c.

3. Findings

3 issues were reported including:

• 1 high severity issue.
• 1 medium severity issue.
• 1 low severity issue.

3.1. 0.5% Token Burning

Severity: High

Description

The token is implemented to burn 0.5% of the token transfered on every transaction, However in transfer:

    function transfer(address to, uint _tokens) public returns (bool success) {
        
        uint tokensBurn =  (_tokens/200);
        uint readyTokens = safeSub(_tokens, tokensBurn);
        burn(owner, tokensBurn);
        
        balances[msg.sender] = safeSub(balances[msg.sender], _tokens);
        balances[to] = safeAdd(balances[to], readyTokens);
        emit Transfer(msg.sender, to, readyTokens);
        return true;
    }

The tokens are added correctly to the new address substracting 0.5% but when calling the owner address inputted where it should be the msg.sender address, once the owner balance is empty the transfers will freeze since transfer will throw at every execution.

Please note that this will cause compatibility issues with many dapps.

Recommendation

    function transfer(address to, uint _tokens) public returns (bool success) {
        
        uint tokensBurn =  (_tokens/200);
        uint readyTokens = safeSub(_tokens, tokensBurn);
        burn(msg.sender, tokensBurn);
        
        balances[msg.sender] = safeSub(balances[msg.sender], readyTokens);
        balances[to] = safeAdd(balances[to], readyTokens);
        emit Transfer(msg.sender, to, readyTokens);
        return true;
    }

3.1. Transfer From

Severity: medium

Description

Users can avoid to burn 0.5% by using transferFrom since no mechanism is implemented to burn 0.5% on a transfe from transaction.

Recommendation

Implement the same logic recommended in 3.1 for transferFrom function.

3.1. Transfers to Address(0)

Severity: low

Description

transfer and transferFrom allow transfers to address 0, this issue has caused millions of losses for many tokens.

Developers should add a requirement to avoid _to address to be equal to zero.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

4. Conclusion

The audited contract cannot be deployed for safety concerns.