ETH_Dai_audit_report.md

Dai audit report.

1. Summary

This document is a security audit report performed by danbogd, where Dai has been reviewed.

2. In scope

Сommit hash .

• xxx.sol.

3. Findings

In total, 4 issues were reported including:

• 0 medium severity issues
• 3 low severity issues
• 1 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
• 0 notes.

No critical security issues were found.

3.1. No checking for zero address

Severity: low

Description

Incoming addresses should be checked for an empty value(0x0 address).

Line 129.

        function setOwner(address owner_)
        public
        auth
        {
        owner = owner_;
        LogSetOwner(owner);
        }

3.2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3.3. ERC20 Compliance.

Severity: low

Description

Accroding to ERC20 standard, when initializing a token contract if any token value is set to any given address a transfer event should be emited.

Code snippet

        function DSTokenBase(uint supply) public {
        _balances[msg.sender] = supply;
        _supply = supply;
        }

3.4. Owner Privileges

Severity: owner previliges

Description

Contract owner allow himself to:

pause/unpause transferFrom, approve, mint, burn functions

        modifier stoppable {
        require(!stopped);
        _;
        }

4. Conclusion

The review did not show any critical issues, some of low severity issues were found.