ETH_axmtoken_audit_report.md

axmtoken audit report.

1. Summary

This document is a security audit report performed by danbogd, where axmtoken has been reviewed.

2. In scope

Сommit hash 8ac50f805184bade0fb9470aa170e455a254e6f8.

• axm.sol.

3. Findings

In total, 4 issues were reported including:

• 1 high
• 1 medium severity issues
• 1 low severity issues
• 0 owner privileges (ability of owner to manipulate contract, may be risky for investors).
• 1 notes.

No critical security issues were found.

3.1. Bug in the code

Severity: high

Description

In this implementation, if the investor wants to purchase the remaining tokens for a large amount he will get them for free.

Code snippet

https://github.com/mahamihirion/axmtoken/blob/8ac50f805184bade0fb9470aa170e455a254e6f8/axm.sol#L276-L291

3.2. Incorrect totalSupply

Severity: medium

Description

Under totalSupply the investor understands the total number of tokens, but this indicator starts to grow up to 200000010**18. After the end of sales, on the owner balance still remains 100000010**18 tokens. It is not good for investors.

Code snippet

https://github.com/mahamihirion/axmtoken/blob/8ac50f805184bade0fb9470aa170e455a254e6f8/axm.sol#L293 https://github.com/mahamihirion/axmtoken/blob/8ac50f805184bade0fb9470aa170e455a254e6f8/axm.sol#L257-L258

3.3. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3.4. Discrepancy with the ERC20 standard

Severity: note

Description

In AssamToken contract, according to the ERC20 standard, the variable decimals should be declared as uint8.

Code snippet

https://github.com/mahamihirion/axmtoken/blob/8ac50f805184bade0fb9470aa170e455a254e6f8/axm.sol#L330

4. Conclusion

The audited smart contract is not safe to deploy.