iOWN Token smart contract security audit report performed by Callisto Security Audit Department
iOWN Token is an ERC20 token for iOWN project based on Openzeppelin. It is intended work as a standard ERC-20 Utility token, to be traded on exchanges and used for payments on iOWN Platform when it is released.
The contract has minor functionalities added to satisfy requirements: like releasing token as ODR (on demand release balance: ODR will be released later on).
Commit hash: c559f9ee36f1da2b9fd520a0200ee43b95ac848c
- IownToken.sol
- CappedBurnableToken.sol
- Migrations.sol
- TokenTreasury.sol
- TransfererRole.sol
- UpgradeAgent.sol
- UpgradeableToken.sol
In total, 5 issues were reported including:
-
1 low severity issues.
-
2 notes.
-
2 owner privileges (the ability of an owner to manipulate contract, may be risky for investors).
No critical security issues were found.
-
It is possible to double withdrawal attack. More details here.
-
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.
Add the following code to the transfer(_to address, ...) function:
require( _to != address(this) );
- The contract owner allowed to pause and freeze functions of contract (
transfer,transferFrom). - The owners can upgrade contract and implement any logic in the new contract.
_upgradeReady is false by default and there is no way to change this variable. In this case, it is not possible to use the contract upgrade.
There are two same checks
require(tokenAddress != address(0), "Invalid token owner address provided");
require(tokenAddress != address(0), "Invalid token address provided");But no check of owner address.
The audited smart contract can be deployed. Only low severity issues were found during the audit.
https://gist.github.com/yuriy77k/20d2b459f6dbe4d6dcd43ae90d1079ec
https://gist.github.com/yuriy77k/5f53d294b69490a3691d644006f15180
https://gist.github.com/yuriy77k/90b9e897b308dd62beb4395c94fd7a0f