ETH_CRAD CASH_audit_report.md

CRAD CASH audit report.

1. Summary

This document is a security audit report performed by danbogd, where CRAD CASH has been reviewed.

2. In scope

Сommit hash .

• crad_cash_latest_2.sol.

3. Findings

In total, 3 issues were reported including:

• 1 medium severity issues.
• 2 low severity issues.

No critical security issues were found.

3.1. ERC223 Standard Compliance.

Severity: medium

Description

The reviewed token contract is not ERC223 fully compliant.

1. The function transfer(address _to, uint _value, bytes _data) call tokenFallback external function on the receiver contract before adding the value to balances[_to]. The original implementation adds the token value to the balance before making the external call check the link below.

2. The function transfer(address _to, uint256 _value) didn't call tokenFallback external function on the receiver contract at all.

Code snippet

Lines: 152-153.

Recommendation Use sample from Dexarans' ERC223 token description.

3.2. Extra checking.

Severity: low

Description

Extra checking in lines 96, 109-110 lines. SafeMath library checks it anyway.

Recommendation

Those lines may be deleted.

3.3. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

4. Conclusion

The review did not show any critical issues, some of medium and low severity issues were found.