Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
MKR Token security audit report

MKR Token security audit report

Summary

This is the report from a security audit performed on MKR Token by gorbunovperm.

Audit of Top 200 CoinMarketCap tokens.

https://makerdao.com/

In scope

  1. DSToken.sol

Findings

In total, 5 issues were reported including:

  • 0 high severity issue.

  • 0 medium severity issues.

  • 5 low severity issues.

  • 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

  • It is possible to double withdrawal attack. More details here

  • Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. ERC20 Compliance — event missing

Severity: low

Code snippet

  1. initial supply; mint function
  2. burn function and Transfer event

Description

  1. According to ERC20 standard when coins are minted a Transfer event should be emitted.
  2. The burn function also should emit the Transfer event.

3. It is necessary to check the input address of transfer function.

Severity: low

Code snippet

Description

  1. In the transfer and transferFrom functions, input destination address is not checked for a null value and the funds can be transferred to a 0x0-address.
  2. Also it is needed to check input address for setOwner and setAuthority function.

4. Default approve value

Severity: low

Code snippet

Description

In case if the approve function is called with only "beneficiary" address parameter then max-uint value(!) of token will be approved to recipient.

Also the approved value doesn't decrease when trnsferFrom called in case of max-uint approved value. It is some sort of ERC20 discrepancy.

5. Owner's Privileges

Severity: low

Code snippet

Description

The contract owner allow himself to pause functions of contract (transfer, transferFrom, approve, mint, burn).

Conclusion

There are some vulnerabilities were discovered in this contract.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.