ETH_Enjin_report.md

Summary

This is the report from a security audit performed on Enjin by MrCrambo.

The audit focused primarily on the security of Enjin smart contract.

In scope

1. https://etherscan.io/address/0xf629cbd94d3791c9250152bd8dfbdf380e2a3b9c#contracts

Findings

In total, 3 issue was reported including:

• 0 high severity issues.

• 1 medium severity issues.

• 0 owner privilegies issues.

• 2 low severity issues.

• 0 notes.

Security issues

1. Integer underflow

Severity: medium

Description

In function releaseEnjinTeamTokens in line 413 there is possibility of integer underflow in line 417. If now will be less than endTime, then there will be integer underflow, that will mean, that currentTranche value will be great. So team will be able to release all team tokens before endTime.

Recommendation

Add checking, that now is gretaer than endTime.

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3. totalAllocated greater than total supply

Severity: low

Description

There is possiblity, that totalAllocated value will be greater than total supply, because owners can call addToAllocation any time they want.

Recommendation

Add checking, that totalAllocated is less than total supply.

Conclusion

Smart contract contains medium severity issue.