IoTeX

[MillianoConti]

Audit request

IoTeX uses Roll-DPoS, where Delegates “prove their stake” by committing time, hardware, and tokens to the network. https://member.iotex.io/

Source code

https://github.com/iotexproject/IOTX-token-contracts/tree/master/contracts

Exclude Migration.sol

Disclosure policy

https://t.me/IoTeXGroup

Platform

Eth

Number of lines:

183

[yuriy77k]

@MillianoConti when you add audit requests, please, use only form on our website. The request will be added automatically to github. In request description you can indicate that it from you.

[danbogd]

Auditing time: 1 day.

[danbogd]

My report is finished.

[MrCrambo]

Auditing time 1 day

[yuriy77k]

@MrCrambo @danbogd assigned

[MrCrambo]

My report is finished

[gorbunovperm]

Estimated auditing time is 1 day.

[yuriy77k]

@gorbunovperm assigned

[gorbunovperm]

My report is finished.

[yuriy77k]

IoTeX Security Audit Report

1. Summary

IoTeX smart contract security audit report performed by Callisto Security Audit Department

2. In scope

Сommit hash 13b1b1053529effce653deabfec427b70800eb42.

• Pausable.sol.
• SafeMath.sol.
• Ownable.sol.
• BasicToken.sol.
• ERC20.sol.
• ERC20Basic.sol.
• StandardToken.sol.
• IoTeXNetwork.sol.

3. Findings

In total, 2 issues were reported including:

• 1 low severity issues.

• 1 owner privileges (the ability of an owner to manipulate contract, may be risky for investors).

No critical security issues were found.

3.1. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );

3.2. Owner Privileges

Severity: owner previliges

Description

Contract owner allow himself to:

to pause functions of contract (transfer, transferFrom, approve, increaseApproval, decreaseApproval) here.

4. Conclusion

The audited smart contract can be deployed. Only low severity issues were found during the audit.

5. Revealing audit reports

https://gist.github.com/yuriy77k/45a3751e1d135df8f6db33ee8df7ae9d

https://gist.github.com/yuriy77k/b350f165d69377de14d160988ba78196

https://gist.github.com/yuriy77k/b9d7f27bfc2ff25385c44431a14ea135

[MillianoConti]

Reddit Announced