ETH_AMO_report.md

Summary

This is the report from a security audit performed on AMO by MrCrambo.

The audit focused primarily on the security of AMO smart contracts.

In scope

1. https://github.com/AMO-Project/AMO-Contracts/blob/master/contracts/AMOCoin.sol
2. https://github.com/AMO-Project/AMO-Contracts/blob/master/contracts/AMOCoinSale.sol

Findings

In total, 7 issues were reported including:

• 0 high severity issues.

• 2 medium severity issues.

• 3 owner privilegies issues.

• 2 low severity issues.

Security issues

1. Zero address

Severity: low

Description

There is possibility of setting zero address as admin in function AMOCoin and as contract address in function setTokenSaleAmount.

Recommendation

Check address for zero address:

require(_adminAddr != address(0));

2. Transfer disabling

Severity: Owner privilegies

Description

Owner can disable transfer functions any time he wants.

3. Account locking

Severity: medium

Description

Owner can disable any amount of tokens for any address using function lockAccount.

4. Modifier will block correct working

Severity: low

Description

Modifier will fail the function in case of transfering funds to sale address. For example in function setTokenSaleAmount there are approving funds for tokenSaleAddr. And after it should be transfered from to this address, but transferFrom function checks with using onlyValidDestination(to) modifier.

5. Out of gas

Severity: medium

Description

In function allocateTokensToMany there is possibility of Out of gas in case array will have lot of addresses and function should be call transferFrom function each time.

6. Owner can change Sale details at any time

Severity: Owner privilegies

Description

Owner can change minContribution, maxContribution, rate and hardCap for each sale round before starting sale.

7. Owner can start rounds in any order

Severity: Owner privilegies

Description

Owner can start any round in any order, because there is no checking in function setUpSale that rounds will be in correct order.

Conclusion

Smart contract contains medium severity issues and should be fixed.