OMG Token security audit report

ETH_OMGToken_report.md

OMG Token security audit report

Summary

This is the report from a security audit performed on OMG Token by gorbunovperm.

Audit of Top 200 CoinMarketCap tokens.

In scope

1. OMGToken.sol

Findings

In total, 5 issues were reported including:

• 0 high severity issue.

• 1 medium severity issues.

• 4 low severity issues.

• 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

• It is possible to double withdrawal attack. More details here

• Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. Poor workaround of Short Address Attack

Severity: low

Code snippet

• onlyPayloadSize

Description

onlyPayloadSize modifier is workaround to avoid the Short Address Attack. But it doesn't work properly.

1. This method failed to execute when it was called from Parity multisignature wallet. The EVM pads call from this multisignature wallet, making the total 96 bytes instead of the expected 68.

2. If transfer and transferFrom are used by a subcontract function with fewer arguments, the onlyPayloadSize check will fail. It is not possible to adapt the workaround to prevent this issue.

More details here.

Recommendation

Remove this workaround.

3. ERC20 Compliance — event missing

Severity: low

Code snippet

• mint function and Transfer event

Description

The mint function should emit the Transfer event.

4. Owner's Privileges

Severity: medium

Code snippet

• whenNotPaused

Description

The contract owner allow himself to pause functions of contract (transfer, transferFrom).

5. Required check for an empty address

Severity: low

Code snippet

• transfer
• transferFrom

Description

It is possible to send tokens to 0x0 address by accidently.

Recommendation

Use condition require(_to != address(0));.

Conclusion

There are some vulnerabilities were discovered in this contract.