ETH_NEXO_report.md

Summary

This is the report from a security audit performed on NEXO by MrCrambo.

The audit focused primarily on the security of NEXO smart contract.

In scope

1. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/NexoToken.sol
2. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/utils/AbstractToken.sol
3. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/utils/Owned.sol
4. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/utils/SafeMath.sol
5. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/utils/StandardToken.sol
6. https://github.com/nexofinance/NEXO-Token/blob/master/contracts/utils/Token.sol

Findings

In total, 2 issues were reported including:

• 0 high severity issues.

• 1 medium severity issues.

• 0 owner privilegies issues.

• 1 low severity issues.

• 0 notes.

Security issues

1. Owner allowance

Severity: medium

Description

Owner allows himself to call transferFrom function from investors, community and advisers address, so there is risk to investors, that owner will transfer this tokens to another address.

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

Conclusion

Smart contracts contain medium severity issue.