Skip to content

Instantly share code, notes, and snippets.

@yuriy77k
Forked from MrCrambo/ETH_Pundix_report.md
Created June 4, 2019 07:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yuriy77k/72b57e6c662bf0413e4ad11190db1977 to your computer and use it in GitHub Desktop.
Save yuriy77k/72b57e6c662bf0413e4ad11190db1977 to your computer and use it in GitHub Desktop.

Summary

This is the report from a security audit performed on Pundi X by MrCrambo.

The audit focused primarily on the security of Pundi X smart contract.

In scope

  1. https://etherscan.io/address/0xa15c7ebe1f07caf6bff097d8a589fb8ac49ae5b3#contracts

Findings

In total, 4 issues were reported including:

  • 0 high severity issues.

  • 0 medium severity issues.

  • 1 owner privilegies issues.

  • 3 low severity issues.

Security issues

1. No events

Severity: low

Description

There is no event in function transferOwnership at line 71.

2. Zero address checking

Severity: low

Description

There are no zero address checking in functions deposit at line 212, mint at line 389, deposit at line 465

3. Known vulnerabilities of ERC-20 token

Severity: low

Description

  1. It is possible to double withdrawal attack. More details here
  2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

4. Owner privilegies

Severity: owner privilegies

Description

Owner can pause transfers any time. Line 539.

Conclusion

Smart contract is free of critical issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment