ETH_SafePost_audit_report.md

SafePost audit report.

1. Summary

This document is a security audit report performed by danbogd, where SafePost has been reviewed.

2. In scope

Сommit hash .

• safepost_solidity.js.
• spaccount_v.3_solidity.js.

3. Findings

In total, 4 issues were reported including:

• 0 medium severity issues
• 3 low severity issues
• 1 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
• 0 notes.

No critical security issues were found.

3.1. ERC20 Compliance — event missing

Severity: low

Description

According to ERC20 standard when coins are minted a Transfer event should be emitted.

Code snippet

safepost_solidity.js Line 34.

3.2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3.3. Contract accept payment from anyone.

Severity: low

Description

An anybody, who send Ether to contract address may lose it because of no payment processing in contract code.

Code snippet

spaccount_v.3_solidity.js Line 19.

3.4. Owner Privileges

Severity: owner previliges

Description

Contract owner allow himself to:

• can transfer funds to any account with any restrictions.

spaccount_v.3_solidity.js Lines 30, 39.

4. Conclusion

The review did not show any critical issues, some of low severity issues were found.