VANMToken.md

Summary

This is the report from a security audit performed on VANMToken by MrCrambo.

The audit focused primarily on the security of VANMToken smart contract.

In scope

1. https://github.com/VANMofficial/Token-Sale/blob/master/VANMToken.sol

Findings

In total, 1 issues were reported including:

• 0 high severity issues.

• 1 medium severity issues.

• 1 low severity issues.

Security issues

1.More balance at incentivising address

Severity: medium

Description

In constructor there is setting 20% of tokens to incentivisingAddress at line 225, but this address is equal to zero address, because it's not inetialised. In functions transferFromPresale and transferFromCrowdsale there are no zero address checking and tokens could be sent to zero address by admins of presale and crowdsale. It means that balance of incentivising address will be greater than 20%.

Recommendation

Add zero address checking or initialise incentivisingAddress before setting its balance.

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Conclusion

Smart contract has medium severity issues, please fix it before deploying.