ETH_Magicchain_report.md

Summary

This is the report from a security audit performed on Magicchain by MrCrambo.

The audit focused primarily on the security of Magicchain smart contract.

In scope

1. https://github.com/magicchain/magicchain-blockchain/blob/master/smartcontracts/MagicChain223.sol

Findings

In total, 2 issues was reported including:

• 0 high severity issues.

• 1 medium severity issues.

• 1 low severity issues.

Security issues

1. Owner privilegies

Severity: low

Description

1. Wrong unfreezed amount

Severity: medium

Description

There should be in total 2 * _inititalSupply tokens, where only half of them freezed. But in function unfreezed there is comparing unfreezed amount with _totalSupplyLimit instead of camparing with only half of _totalSupplyLimit. And because of this there is possibility of unfreezing two times more tokens.

Recommendation

Change the unfreezed function as below

    function unfreezed() view public returns(uint) {
        uint u = block.number.sub(_firstBlock).mul(_unfreezeTokensPerBlock);
        if(u > _initialSupply) {
            u = _initialSupply;
        }
        return u;
    }

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

Conclusion

Smart contract contains medium severity issue.