Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
BAT Token security audit report

BAT Token security audit report


This is the report from a security audit performed on BAT Token by gorbunovperm.

Audit of Top 200 CoinMarketCap tokens.

In scope

  1. BAToken.sol


In total, 4 issues were reported including:

  • 0 high severity issue.

  • 1 medium severity issues.

  • 3 low severity issues.

  • 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low


  • It is possible to double withdrawal attack. More details here

  • Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here


Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. ERC20 Compliance — transfer should throw

Severity: medium

Code snippet


From ERC-20 specification:

The function SHOULD throw if the _from account balance does not have enough tokens to spend.

But in this implementation it just returns false. This can lead to serious consequences. Because checking the return value of this function is rare. For example, external contract may use this token contract as:

BatToken.transferFrom(recipient, this, value);
points[recipient] += value;

In this case recipient can get any value of points, but he may not have enough money and the code will succeed.

3. ERC20 Compliance — zero-value transfers rejecting

Severity: low

Code snippet


EIP20 says that:

Transfers of 0 values MUST be treated as normal transfers and fire the Transfer event. But in this contract, function transfer has a condition:

if (balances[msg.sender] >= _value && _value > 0) {
    // ...

4. ERC20 Compliance — event missing

Severity: low

Code snippet

  1. initial supply
  2. createTokens function and Transfer event


  1. According to ERC20 standard when coins are minted a Transfer event should be emitted.

  2. The createTokens function also should emit the Transfer event.


There are some vulnerabilities were discovered in this contract.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.