yuriy77k commented 5 years ago

Audit request

Audit Top 200 CoinMarketCap tokens.

Zilliqa	ZIL
Circulating Supply	8 750 823 775
Total Supply	12 599 999 804

Deployed at https://etherscan.io/address/0x05f4a42e251f2d52b8ed15e9fedaacfcef1fad27#code

Zilliqa (ZIL)
https://www.zilliqa.com/

Source code

https://gist.github.com/yuriy77k/cd476ddc9a1c1685dc39e399fcd08b3e

Disclosure policy

Public

Platform

ETH

Number of lines

192

RideSolo commented 5 years ago

Estimated audit time: 1 day.

yuriy77k commented 5 years ago

@RideSolo assigned

danbogd commented 5 years ago

Auditing time: ~ 2 days.

gorbunovperm commented 5 years ago

Estimated auditing time is 1 day.

danbogd commented 5 years ago

My report is finished.

yuriy77k commented 5 years ago

@gorbunovperm @danbogd assigned

gorbunovperm commented 5 years ago

My report is finished.

yuriy77k commented 5 years ago

Security Audit Report

1. Summary

Zilliqa Token smart contract security audit report performed by Callisto Security Audit Department

Token desription:

Symbol      : ZIL
Name        : Zilliqa
Total supply: To be set in the construction phase
Decimals    : 12
Standard    : ERC20

2. In scope

ZilliqaToken.sol.

3. Findings

In total, 3 issues were reported including:

3 low severity issues.

No critical security issues were found.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

It is possible to double withdrawal attack. More details here.
Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );

3.2. Transfer Admin to zero address.

Severity: low

Description

Possibility of setting zero address as newAdnin at changeAdmin function.

Code snippet

lines 344-348

Recommendation

Need to check if newOwner address is not zero address.

require( newAdmin != address(0) );

3.3. Owner Privileges

Severity: low

Description

The contract owner allow himself:

to pause functions of contract (transfer, transferFrom, approve, increaseApproval, decreaseApproval), besides burn function;
Evacuate Tokens at any time.

The contract is managed manually by the owner which is not good for investors.