Closed RobertBobor closed 7 months ago
VIS-DEI smart contract security audit report performed by Callisto Security Audit Department
Commit: 93135602752eff72097f602dae44b0d1bed5986d
generic:
staking:
token:
vesting:
In total, 1 issue were reported, including:
0 high severity issues.
1 medium severity issue.
0 low severity issues.
In total, 5 notes were reported, including:
1 minor observation.
4 owner privileges.
There are multiple issues in the function removeOwner
:
ownersLength
initiated before removing the owner, so condition if (requiredApprovals > ownersLength)
will be always false
since you compare requiredApprovals
with the old ownersLength
. changeRequirement(ownersLength);
which will fail, because it requires enough approvals.Replace this part https://github.com/VIS-DEI/smart-contracts-public/blob/93135602752eff72097f602dae44b0d1bed5986d/contracts/generic/TimeMultisig.sol#L166-L169 with:
ownersLength--;
if (requiredApprovals > ownersLength){
_changeRequirement(ownersLength);
}
For dust amount of tokens, the function currentPrice()
would always be zero allowing wallets to buy tokens without paying any USDT tokens.
Add in the and of function currentPrice following requirement:
require(price != 0, "Too small amount");
CREATE (0xf0)
opcode is assigned following this scheme keccak256(rlp([sender, nonce]))
. Therefore you need to use the same address that was originally used at the main chain to deploy the mock contract at a transaction with the nonce
that matches that on the original chain. Example: If you have deployed your main contract with address 0x010101 at your 2021th transaction then you need to increase your nonce of 0x010101 address to 2020 at the chain where your mock contract will be deployed. Then you can deploy your mock contract with your 2021th transaction, and it will receive the same address as your mainnet contract.The audited smart contract must not be deployed. Reported issues must be fixed before the usage of this contract.
Staking contract do not guarantee users that they will be able to withdraw their deposits if tokens for interest are not added by the owner.
It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract's operability and prevent any issues that are not directly related to the code of this smart contract.
VIS-DEI smart contract security audit report performed by Callisto Security Audit Department
Commit: 4f036260dce9a439c16afcb3dfd298535483e2c7
generic:
staking:
token:
vesting:
In total, 0 issues were reported, including:
0 high severity issues.
0 medium severity issues.
0 low severity issues.
In total, 4 notes were reported, including:
0 minor observations.
4 owner privileges.
CREATE (0xf0)
opcode is assigned following this scheme keccak256(rlp([sender, nonce]))
. Therefore you need to use the same address that was originally used at the main chain to deploy the mock contract at a transaction with the nonce
that matches that on the original chain. Example: If you have deployed your main contract with address 0x010101 at your 2021th transaction then you need to increase your nonce of 0x010101 address to 2020 at the chain where your mock contract will be deployed. Then you can deploy your mock contract with your 2021th transaction, and it will receive the same address as your mainnet contract.The audited smart contract can be deployed. No security issues were found during the audit.
Users should pay attention to owners' privileges.
Staking contract do not guarantee users that they will be able to withdraw their deposits if tokens for interest are not added by the owner.
It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract's operability and prevent any issues that are not directly related to the code of this smart contract.
Audit request
We would like to have 4 smart contracts to be audited:
vesting/VestingFactory.sol staking/Staking.sol token/Launchpad.sol generic/TimeMultisig.sol
Descriptions for each of them can be found in README files in corresponding folders.
Source code
https://github.com/VIS-DEI/smart-contracts-public/tree/main/contracts
Payment plan
Disclosure policy
Please notify me privately.
Contact information (optional)
robert.bobor@dei.cz
Platform
ETH