ETH_GenesisVision_audit_report.md

Genesis Vision audit report.

1. Summary

This document is a security audit report performed by danbogd, where Genesis Vision has been reviewed.

2. In scope

Сommit hash 4eca90915580f209e86db8270c4f53d6e645712b.

• Models.sol.
• GenesisVisionPlatform.sol.
• ManagerToken.sol.
• Migrations.sol.
• TradingHistoryStorage.sol.

3. Findings

In total, 6 issues were reported including:

• 0 medium severity issues
• 4 low severity issues
• 1 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
• 1 notes.

No critical security issues were found.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3.2. Owner Privileges

Severity: owner previliges

Description

Contract owner allow himself to:

change TotalSupply here.

3.3. Required check for an 0x0 address

Severity: low

Description

It is possible to remain out of contract control by accidentally calling function without parameter.

Code snippet

https://github.com/GenesisVision/platform-contracts/blob/4eca90915580f209e86db8270c4f53d6e645712b/contracts/GenesisVisionPlatform.sol#L39 https://github.com/GenesisVision/platform-contracts/blob/4eca90915580f209e86db8270c4f53d6e645712b/contracts/TradingHistoryStorage.sol#L30

3.4. Discrepancy with the ERC20 standard

Severity: note

Description

In ManagerToken.sol, according to the ERC20 standard, the variable decimals should be declared as uint8.

Code snippet

https://github.com/GenesisVision/platform-contracts/blob/4eca90915580f209e86db8270c4f53d6e645712b/contracts/ManagerToken.sol#L10

3.5. Missing event call.

Severity: low

Description

According to ERC20 standard, when initializing a token contract if any token value is set to any given address a transfer event should be emitted.

Code snippet

https://github.com/GenesisVision/platform-contracts/blob/4eca90915580f209e86db8270c4f53d6e645712b/contracts/ManagerToken.sol#L26

3.6. Overflow

Severity: low

Description

In the ManagerToken.sol, the developers didn't use SafeMath to prevent overflow by the owner.

Code snippet

https://github.com/GenesisVision/platform-contracts/blob/4eca90915580f209e86db8270c4f53d6e645712b/contracts/ManagerToken.sol#L29

4. Conclusion

The review did not show any critical issues, some low severity issues were found.