This document is a security audit report performed by danbogd, where Burn token has been reviewed.
Сommit hash .
In total, 4 issues were reported including:
- 1 medium severity issues
- 3 low severity issues
- 0 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
- 0 notes.
No critical security issues were found.
There is no upper limit on receivers.length. Eventually, as the length of arrays increases, gas cost of smart contract calls will raise. This can lead to "Out of Gas" error or to "Block Gas Limit".
Line 128
function multiTransfer(address[] memory receivers, uint256[] memory amounts) public {
for (uint256 i = 0; i < receivers.length; i++) {
transfer(receivers[i], amounts[i]);
}
}
-
It is possible to double withdrawal attack. More details here.
-
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.
Add into a function transfer(address _to, ... )
following code:
require( _to != address(this) );
There are two input arrays, but no check for the same length. In this case it is possible to skip some recipient or token amount and to transfer wrong amount to wrong recipient.
Line 128
function multiTransfer(address[] memory receivers, uint256[] memory amounts) public {
for (uint256 i = 0; i < receivers.length; i++) {
transfer(receivers[i], amounts[i]);
}
}
decreaseAllowance throw in case if the value to be subtracted is higher than the amount that is allowed, if the address owner wants to change the value allowed by reducing it and the spender withdraw a part of it before, the function might throw and give more chances for the spender to take the rest of the allowed value.
The value should be set to zero if the value to be subtracted is higher than the allowance.
Line 169.
function decreaseAllowance(address spender, uint256 subtractedValue) public returns (bool) {
require(spender != address(0));
_allowed[msg.sender][spender] = (_allowed[msg.sender][spender].sub(subtractedValue));
emit Approval(msg.sender, spender, _allowed[msg.sender][spender]);
return true;
}
The review did not show any critical issues, some of medium and low severity issues were found.