ETH_WeidexV2_report.md

Summary

This is the report from a security audit performed on WeidexV2 by MrCrambo.

The audit focused primarily on the security of Weidex V2 smart contracts.

In scope

1. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/utils/LibCrowdsale.sol
2. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/utils/LibMath.sol
3. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/utils/LibOrder.sol
4. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/utils/LibSignatureValidator.sol
5. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/mocks/OldERC20.sol
6. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/mocks/SimpleOldToken.sol
7. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/mocks/SimpleToken.sol
8. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/interfaces/IExchangeUpgradability.sol
9. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/Exchange.sol
10. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/ExchangeBatchTrade.sol
11. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/ExchangeMovements.sol
12. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/ExchangeOffering.sol
13. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/ExchangeStorage.sol
14. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/ExchangeUpgradability.sol
15. https://github.com/weichain/weidex-eth-v2/blob/master/contracts/exchange/WeiDex.sol

Findings

In total, 3 issues were reported including:

• 0 high severity issues.

• 0 medium severity issues.

• 1 owner privilegies issues.

• 2 low severity issues.

Security issues

1. Zero address checking

Severity: low

Description

In function transfer and transferFrom there are no zero address checking

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3. Owner privilegies

Severity: owner privilegies

Description

Owner can change exchange address if he wants and contract could be with issues, if it's not audited. And also there is no zero address checking.

Conclusion

Smart contracts contain only low severuty issues.