ETH_ExploreCoin_report.md

Summary

This is the report from a security audit performed on ExploreCoin by MrCrambo.

The audit focused primarily on the security of ExploreCoin smart contract.

In scope

1. https://etherscan.io/address/0x2802faad8a0f9595c1660c436c7e51d9ce97b1e9#code

Findings

In total, 4 issues were reported including:

• 0 high severity issues.

• 1 medium severity issues.

• 0 owner privilegies issues.

• 3 low severity issues.

Security issues

1. Wrong transferFrom work

Severity: medium

Description

In transferFrom function firstly called transfer function and then approve function, but if approve will be failed in case of transfering more than allowed amount, than there will be Logs in Blockchain, that transfer happened, but it didn't. So in case when dapps will work with Logs, then this transferFrom will be considered to have occurred, but it won't.

2. Zero address checking required

Severity: low

Description

In constructor at line 306 there need zero address checking for feeReceiver and tokenOwnerAddress.

3. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

4. Extra functions

Severity: low

Description

Functions _burn and _burnfrom are internal and never will be able to call.

Conclusion

Smart contract contains medium severity issue.