0xBTC_audit_report.md

0xBTC Smart Contract Audit Report.

1. Summary

This document is a security audit report performed by danbogd, where 0xBTC Smart Contract has been reviewed.

2. In scope

• _0xBitcoinToken.sol github commit hash ec69855517142c2acbb32a976d0d6febb5df0c10.

3. Findings

In total,2 issues were reported including:

• 2 low severity issues.
• 2 minor observation

No critical security issues were found.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

3.2. No checking for zero address.

Severity: low

Description

Transfer & transferFrom functions do not prevent from sending tokens to address 0x0.

Recommendation

Add zero address checking

require(to != address(0));

3.3. Redundant function().

Severity: minor observation

Description

We believe that function () with revert was a pattern used to prevent implicit acceptance of ether in Solidity versions older than 0.4.0, but today this is unneeded.

Code snippet

https://github.com/0xbitcoin/0xbitcoin-token/blob/ec69855517142c2acbb32a976d0d6febb5df0c10/contracts/_0xBitcoinToken.sol#L642-L646

3.4. Consider using latest version of solidity.

Severity: minor observation

Description

The contracts use solidity version 0.4.18. It is suggested to use the latest version and fix all compiler warnings that arise.

4. Conclusion

No critical vulnerabilities were detected,but we highly recommend to complete this bugs before use.