VANM token smart contract security audit report performed by Callisto Security Audit Department
It's main purpose was/is...
• the creation of the VANM token (ERC20)
• handling our token sale in two phases including balance checks, overflow and whitelisting.
Commit hash: 1c0995c827b200c76e90efe3a809096a71251581
In total, 6 issues were reported including:
-
5 low severity issues.
-
1 minor observation.
No critical security issues were found.
-
It is possible to double withdrawal attack. More details here
-
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here
In the setPresaleAddress and setCrowdsaleAddress function, the input address is not checked for a null value and the funds can be transferred to a 0x0-address.
balances[_presaleAddress] = balances[_presaleAddress].add(presaleSupply);In the constructor is the event of the transfer of funds to address platformAddress, but there is no event on the transfer of funds to address incentivisingAddress.
balances[platformAddress] = platformSupply;
emit Transfer(0x0, platformAddress, platformSupply);
balances[incentivisingAddress] = incentivisingSupply;In functions transferFromIncentivising, transferFromPresale and transferFromCrowdsale the Transfer event is called but as argument from is used 0x0 instead address of corresponding contract. This can be misleading.
In constructor there is setting 20% of tokens to incentivisingAddress, but this address is equal to zero address, because it's not initialized. In functions transferFromPresale and transferFromCrowdsale there are no zero address checking and tokens could be sent to zero address by admins of presale and crowdsale. It means that balance of incentivising address will be greater than 20%.
Initialize incentivisingAddress before setting its balance.
The function () payable { revert(); } was a pattern used to prevent implicit acceptance of ether in Solidity versions older than 0.4.0, but today this is unneeded.
No major vulnerabilities were found but pointed issues need addressed.
https://gist.github.com/yuriy77k/473a271e22c53948c06fb525b4a63a4a
https://gist.github.com/yuriy77k/00ebeedf68be6dc0acd07e1052a50408
https://gist.github.com/yuriy77k/ce842ba28365844c6ba3ac4615f56b45