ETH_AsureToken_report.md

Summary

This is the report from a security audit performed on AsureToken by MrCrambo.

The audit focused primarily on the security of AsureToken smart contracts.

In scope

1. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/test/TestAsureBonusesCrowdsale.sol
2. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/test/TestToken.sol
3. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/AsureBonusesCrowdsale.sol
4. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/AsureCrowdsale.sol
5. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/AsureCrowdsaleDeployer.sol
6. https://github.com/AsureNetwork/crowdsale/blob/master/packages/crowdsale/contracts/AsureToken.sol

Findings

In total, 4 issues were reported including:

• 0 high severity issues.

• 2 medium severity issues.

• 1 owner privilegies issues.

• 1 low severity issues.

Security issues

1. Owner privilegies

Severity: Owner privilegies

Description

Using function updateRates owner can change rates.

2. Not equal arrays

Severity: medium

Description

In function drop there is possiblity that arrays size will not be equal.

Recommendation

Add checking, that arrays size are equal

require(recipients.length == values.length);

3. Out of gas

Severity: medium

Description

In functions drop, airdrop and mint there are possibilty of going out of gas in case the array will have long length.

4. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

Conclusion

Smart contract contains medium severity issues.