Skip to content

Instantly share code, notes, and snippets.

@yuriy77k
Forked from MrCrambo/ETH_iOWN_report.md
Created May 23, 2019 12:28
Show Gist options
  • Save yuriy77k/5f53d294b69490a3691d644006f15180 to your computer and use it in GitHub Desktop.
Save yuriy77k/5f53d294b69490a3691d644006f15180 to your computer and use it in GitHub Desktop.

Summary

This is the report from a security audit performed on iOWN by MrCrambo.

The audit focused primarily on the security of iOWN smart contracts.

In scope

  1. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/CappedBurnableToken.sol
  2. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/IownToken.sol
  3. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/TokenTreasury.sol
  4. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/TransfererRole.sol
  5. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/UpgradeAgent.sol
  6. https://github.com/iOWNToken/iOWNToken/blob/master/contracts/UpgradeableToken.sol

Findings

In total, 4 issues were reported including:

  • 0 high severity issues.

  • 2 medium severity issues.

  • 1 owner privilegies issues.

  • 1 low severity issues.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

  1. It is possible to double withdrawal attack. More details here
  2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. Owner privilegies

Severity: owner privilegies

Description

  1. Owner can pause any time he wants.

3. Cap should not be decreased

Severity: medium

Description

In functions burn and burnFrom there is decreasing _cap, but it should not be decreased, because it shows maximum capitalisation of tokens.

4. Old owner privilegies

Severity: medium

Description

After transfering ownership to new owner, old owner will still be able to mint, pause and transfer as owner.

Recommendation

Remove the rights of old owner after transfering ownership to new address.

Conclusion

Smart contracts contain medium severity issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment