yuriy77k commented 5 years ago

Audit request

This smart contract is for dClinic organization. dClinic enables EHR and EMR records to be blockchain enabled. VIC tokens will be distributed as a loyalty tokens to all the patients that complete their tasks for shared health care summary. More information is available in www.dclinic.io

Source code

https://github.com/dclinicpteltd/smartContract/blob/master/VIC%20-%20dClinic

Disclosure policy

Ashwani.modi@dclinic.io

Platform

ETH

Number of lines

149

MrCrambo commented 5 years ago

Auditing time 1 day

RideSolo commented 5 years ago

Auditing time: 1 day

yuriy77k commented 5 years ago

@MrCrambo @RideSolo assigned

gorbunovperm commented 5 years ago

Estimated auditing time is 2 days.

yuriy77k commented 5 years ago

@gorbunovperm assigned

gorbunovperm commented 5 years ago

My report is finished.

yuriy77k commented 5 years ago

Security Audit Report

1. Summary

dClinic Token smart contract security audit report performed by Callisto Security Audit Department

2. In scope

VIC - dClinic github commit 8111a327156f62a52614f726f676d7f0a275fda9.

3. Findings

In total, 2 issues were reported including:

2 low severity issues.

No critical security issues were found.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

It is possible to double withdrawal attack. More details here.
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );

3.2. Decrease Allowance

Severity: low

Description

decreaseAllowance throw in case if the value to be subtracted is higher than the amount that is allowed, if the address owner wants to change the value allowed by reducing it and the spender withdraw a part of it, the function might throw and give more chances for the spender to take the rest of the allowed value.