MKR Token security audit report

ETH_MKRToken_report.md

MKR Token security audit report

Summary

This is the report from a security audit performed on MKR Token by gorbunovperm.

Audit of Top 200 CoinMarketCap tokens.

https://makerdao.com/

In scope

1. DSToken.sol

Findings

In total, 5 issues were reported including:

• 0 high severity issue.

• 0 medium severity issues.

• 5 low severity issues.

• 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

• It is possible to double withdrawal attack. More details here

• Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. ERC20 Compliance — event missing

Severity: low

Code snippet

1. initial supply; mint function
2. burn function and Transfer event

Description

1. According to ERC20 standard when coins are minted a Transfer event should be emitted.
2. The burn function also should emit the Transfer event.

3. It is necessary to check the input address of transfer function.

Severity: low

Code snippet

• transferFrom
• setOwner

Description

1. In the transfer and transferFrom functions, input destination address is not checked for a null value and the funds can be transferred to a 0x0-address.
2. Also it is needed to check input address for setOwner and setAuthority function.

4. Default approve value

Severity: low

Code snippet

• default approve value

Description

In case if the approve function is called with only "beneficiary" address parameter then max-uint value(!) of token will be approved to recipient.

Also the approved value doesn't decrease when trnsferFrom called in case of max-uint approved value. It is some sort of ERC20 discrepancy.

5. Owner's Privileges

Severity: low

Code snippet

• stoppable

Description

The contract owner allow himself to pause functions of contract (transfer, transferFrom, approve, mint, burn).

Conclusion

There are some vulnerabilities were discovered in this contract.