ETH_Maker_report.md

Summary

This is the report from a security audit performed on Maker by MrCrambo.

The audit focused primarily on the security of Maker smart contrac.

In scope

1. https://gist.github.com/yuriy77k/527895b7b7a1c00c867970cc9450aa60

Findings

In total, 6 issues was reported including:

• 0 critical severity issues.

• 0 high severity issues.

• 1 medium severity issues.

• 5 low severity issues.

1. Owner privilegies

Severity: medium

Description

Owner can mint any amount of tokens without any restrictions, because owner also could unstop in any time.

Recommendation

Add restrictions to owner.

2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3. Old solidity version

Severity: low

Description

Used solidity version is old.

4. Wrong function returns

Severity: low

Description

The name() and symbol() functions return the bytes32 data type instead of string as recommended in the ERC20 token standard.

5. Wrong function returns

Severity: low

Description

The decimals() function returns the uint256 data type instead of uint8 as recommended in the ERC20 token standard.

6. No events

Severity: low

Description

The mint(...) function should emit the Transfer(address(0), guy, wad) event as the blockchain token explorers will pick this event up.

The burn(...) function should emit the Transfer(guy, address(0), wad) event as the blockchain token explorers will pick this event up.

Conclusion

Smart contract has medium severity issue.