ETH_LuckyStrikeV3_report.md

Summary

This is the report from a security audit performed on LuckyStrikeV3 by MrCrambo.

The audit focused primarily on the security of LuckyStrikeV3 smart contracts.

In scope

1. https://ropsten.etherscan.io/address/0x78c32ffb7d209457a75e6c25854f19de58d64a4b#code
2. https://ropsten.etherscan.io/address/0xfd9f46d87625f1f8ee06fdb7f5e93c745005aae2#code

Findings

In total, 6 issues were reported including:

• 0 high severity issues.

• 3 medium severity issues.

• 3 low severity issues.

Security issues

1. Possibility of minting more than hardCap

Severity: low

Description

In function mint there is possibility of minting more than hardCap.

Line 331 LuckyStrikeToken contract.

Recommendation

You should check (invested + _invested) > hardCap before minting and if it's true, mint only hardCap - invested number of tokens and return remainder to investor.

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3. Game Contract Init

Severity: low

Description

The ether sent through init member of LuckyStrike game contract will be lost in the contract since it is not placed in sum array in any way. Depending the amount to be sent the severity can vary from low to medium.

Line 1498 in LuckyStruke contract.

4. Owner privilegies

Severity: medium

Description

adjustAllocation function member of LuckyStrike allow the owner to reset the rates of the different jackpots and income rate, combined with issue 3.1 the risk for investors can be clear.

Line 1575 in LuckyStruke contract.

5. Truncated Investors Token Value

Severity: medium

Description

Lucky strike token decimals value is equal to zero, which means that no value after the decimal point is saved. When computing the token to mint for an investor, the fifth of the sent value when calling investAndPlay function is used to compute the investment and the other part is used to buy tickets, the fifth of the value is divided by tokenPriceInWei meaning that any value that is not a multiple of tokenPriceInWei will be truncated and the remaining value given to the marketing fund without compensation.

Line 1782 in LuckyStruke contract.

• Knowing that the token price in usd at the moment of writing is 0.0207, the described issue will be expose any user to a loss of value lower than 0.0207 USD and same as described before the gas optimization is not worth it.

• Since 1/5 of the value sent through investAndPlay is used to buy token and 4/5 is used to place a bet, therefor there will be a smaller part of ether that will be lost in the contract or taken without giving token or a fraction of it to back the full investment since 0.00015 * 5 != n tokenPriceInWei + ticketPriceInWei.

6. hardCap issues

Severity: medium

Description

• Once the hardCap or salePeriod reached the sale will be closed and all token minting will stop, therefore if everyone sells its tokens which is a possible case, only withdrawAllByOwner will be able to withdraw all the game contract income meaning that the contract owners will get all the game contract returns.

Line 190 LuckyStrikeToken contract.

• If hardCap is set low enough compared to the 70M tokens distributed initially the contract owners or the four addresses first set by the owner will be guaranteed a minimum return percentage, following the actual contract, the production hard cap will be equal to 4500 ether and the token price will be 0.00015 ether meaning that only 30M tokens will be sold which will guarantee 70% of the contract returns to the four addresses set by the owner.

Line 141 LuckyStrikeToken contract.

Conclusion

Smart contract contains medium severity issues.