yuriy77k/TokenTrader_conclusion.md

## TokenTrader_conclusion.md

      
    Raw
  

              TokenTrader_conclusion.md
            
          
    TokenTrader Smart Contract security audit report performed by Callisto Security Audit Department

Conclusion:

No critical issue, bug fixing is necessary. It is highly recommended to complete a bug bounty before use.
Medium severity issues:


If attacker creates smart contract with '''owner''' variable equal to real owner address and '''asset''' variable equal to real asset there is a risk of send money to this wrong address.

Low severity issues:


The modifier onlyOwnerOrTokenTraderWithSameOwner allows attacker to run function code if it calls form smart contract with '''owner''' variable equal to real owner address. In this contract it can not cause a loss of customers funds or a breach of contracts operability, but you need to be aware of this in future use.


Overflowing is possible if Maker (seller) set UNREAL HIGH sellPrice.


Revealing audit reports:

https://gist.github.com/RideSolo/4b821749ceadf855cb3cb1ca2d21b8bf
https://gist.github.com/gorbunovperm/1872ef525c6f4a03a5014e77e53dafaf
https://gist.github.com/MrCrambo/0a0f088ccf2b2101ea7e39bc010f7d3c
https://gist.github.com/alexo18/6ba63ad2ac5e5c942bb8157e3015cc41
@RideSolo

Notes regarding the https://gist.github.com/yuriy77k/41d0c22e8443e649e6257a7dbb331cc4 report.
When you specify a commit hash, it's better to specify a hash for each file, not for the tree.
For example TokenSellerFactory.sol github commit hash 376cdb1feccc4fb613daff9d6b0130b70cc942ce or short 376cdb1.
Your report is fine.
@gorbunovperm

Notes regarding the https://gist.github.com/yuriy77k/ceaf6eced543789c06bf12a387c1eae5 report.


Double spending attack is possible only in TestERC20Token.sol which "For TESTING ONLY on Testnet or Dev blockchain.". So it may has some bugs.


Overflowing is possible only if market maker (seller) set UNREAL HIGH sellPrice. For example, current Ethereum supply less then 2^24 (or less then 2^78 in Wei), so sellPrice higher then 2^200 only can be set specially for overflowing. I think it has low severity.


In other places overflowing is not possible.


@MrCrambo

Notes regarding the  report.

Transfer to zero address and Double-spend attack is possible only in TestERC20Token.sol which "For TESTING ONLY on Testnet or Dev blockchain.". So it may has some bugs.

Your report is fine.
@alexo18

Notes regarding the https://gist.github.com/yuriy77k/c3a9846a95662e0cfb93f4864ebe3160 report.


Risk of incorrect implementation ERC20 standards functions is equal a risk of fraud asset. We assume that buyer and seller knows operation asset. Not a security issue.


The modifier onlyOwnerOrTokenTraderWithSameOwner usage in this contract can not cause a loss of customers funds or a breach of contracts operability so it has low severity.


Your report is fine.