HIGH_ISSUE_ETH_ETHERC_Security_Audit_Report.md

ETHERC Security Audit Report

1. Summary

This document is a security audit report performed by danbogd, where ETHERC Security has been reviewed.

2. In scope

Сommit hash 8f3739db93588b5141b7eb0116ebaeb303263569.

• ETHERCExchange.sol.
• ETHERCFeeModifiers.sol.
• ETHERCToken.sol.
• TokenStandard.sol.

3. Findings

In total, 3 issues were reported including:

• 1 high severity issues.

• 1 notes.

• 1 owner privileges (ability of owner to manipulate contract, may be risky for investors).

3.1. Burn From

Severity: high

Description

The function burnFrom In TokenTemplate contract, allow an address to burn from another address that has approved token to it, however the burned value is not subtracted from the allowance once the function is executed, making the spender able to burn the total balance of the from address.

The severity of this issue cannot be defined accurately since the usage of the contract containing the issue should be described by the development team, in all the cases the contract should be corrected since the repository is public.

Code snippet

https://github.com/ETHERCIO/smart_contract/blob/master/contracts/test/TokenTemplate.sol#L85

3.2. Owner Privileges:

Severity: owner privileges

Description

In ETHERCExchange. contract the owner is allowed to change maker and taker fees without restrictions.
In ETHERCToken contract the owner is allowed to pause/unpause token transfers and approvals without restrictions.

Code snippet

https://github.com/ETHERCIO/smart_contract/blob/master/contracts/ETHERCExchange.sol#L312

https://github.com/ETHERCIO/smart_contract/blob/master/contracts/ETHERCExchange.sol#L317

https://github.com/ETHERCIO/smart_contract/blob/master/contracts/ETHERCToken.sol#L308#L329

3.3. Deprecated method.

Severity: note

Description

The function () payable { revert(); } was a pattern used to prevent implicit acceptance of ether in Solidity versions older than 0.4.0, but today this is unneeded. Code snippet

https://github.com/ETHERCIO/smart_contract/blob/f6835404b957ec7edc724107260e7ccfdfb6e743/contracts/ETHERCExchange.sol#L157-L159

4. Conclusion

The audited smart contract must not be deployed. Reported issues must be fixed prior to the usage of this contract.