Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?

Summary

This is the report from a security audit performed on by MrCrambo.

The audit focused primarily on the security of aXpire smart contract.

In scope

  1. https://etherscan.io/address/0xC39E626A04C5971D770e319760D7926502975e47#code

Findings

In total, 6 issues were reported including:

  • 0 high severity issues.

  • 2 medium severity issues.

  • 1 owner privilegies issues.

  • 3 low severity issues.

Security issues

1. Wrong transfer and transferFrom realisation

Severity: medium

Description

Function transfer and transferFrom should throw in case of failing transfer, but here it will return false.

2. Owner can burn from any address

Severity: medium

Description

Using function burnFrom owner can burn any amount of token from any address.

Recommendation

Add checking that allowed amount is greater than burning amount.

3. Known vulnerabilities of ERC-20 token

Severity: low

Description

  1. It is possible to double withdrawal attack. More details here
  2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

4. Zero address checking

Severity: low

Description

In functions transfer and transferFrom there is possibility of sending to zero address.

Recommendation

Add zero address checking

require(_to != address(0));

5. Owner privilegies

Severity: owner privilegies

Description

  1. Owner can pause transfers any time he wants.
  2. Owner can change icoTokenExchangeRate any time he wants.
  3. Owner can change haltIco any time he wants.

6. Wrong function working

Severity: low

Description

Function sendFundHome should work as described in comments Ends the funding period and sends the ETH home, but it will only send the funds.

Conclusion

Smart contract contains medium severity issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.