search

EthereumCommonwealth / Auditing

Ethereum Commonwealth Security Department conducted over 400 security audits since 2018. Not even a single contract that we audited was hacked. You can access our audit reports in the ISSUES of this repo. We are accepting new audit requests.
https://audits.callisto.network/
GNU General Public License v3.0
131 stars 34 forks source link

SHUSKY #501

Closed SerecThunderson closed 3 years ago

SerecThunderson commented 3 years ago

Audit request

SHUSKY (Siberian Husky) is a decentralized community token and store of value. 50% burned, 40% locked, 10% dumped on open market already, contract revoked

Source code

https://etherscan.io/address/0x236d53148f83706c3d670064809577385f923a75#code

Disclosure policy

Talk to me first in case it is a misunderstanding, but publish it later

Standard disclosure policy.

Contact information (optional)

admin@SHUSKYTOKEN.com T.me/serecthunderson

https://SHUSKYTOKEN.com https://twitter.com/SHUSKYTOKEN https://t.me/SHUSKYTOKEN https://reddit.com/r/SHUSKYTOKEN https://discord.gg/XGPhdcp9nA

Platform

ETH

yuriy77k commented 3 years ago

@SerecThunderson The audit fee is 672 USDT. You may send USDT (ERC20 or BEP20) to: 0xb9662e592f2f0412be62f0833ca463a9b1aabebb or USDT (TRC20) to: TBzUKbek9AYVBwf91ykh3KY4Ushk95SCiB

The estimated auditing time - 5 days after payment.

SerecThunderson commented 3 years ago

https://etherscan.io/tx/0x591b63076e1487946af55c7089a57091115277adec845f3fd653bb9d3e1f1404

SerecThunderson commented 3 years ago

Thank you kindly for the service.

yuriy77k commented 3 years ago

SHUSKY Security Audit Report

1. Summary

SHUSKY smart contract security audit report performed by Callisto Security Audit Department

2. In scope

https://etherscan.io/address/0x236d53148f83706c3d670064809577385f923a75#code

2.1 Excluded

The correctness of the mathematical calculations was not verified during the audit due to the lack of complete documentation of what the contract should do and under what conditions.

3. Findings

In total, 4 issues were reported including:

3.1. Known vulnerabilities of ERC-20 and BEP-20 token

Severity: low

Description

  1. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );
  1. ERC20 is a widely used standard across the Ethereum ecosystem. It is reasonable to assume that ERC20 tokens could be "accidentally" deposited into this contract even though it is not intentional.

Every user on the entire Ethereum ecosystem can send ERC20 tokens to this contract and he will have no ability to extract it back unless there is a special "ERC20-rescue" function implemented in your contract. It is advised to implement this function.

Example: here is BAT contract address. As you can see the contract itself holds $497,000 worth of different ERC20 tokens - all these tokens are permanently "stuck" inside the contract and therefore uselessly lost.

Recommendation

A simple "ERC20-rescue" function can solve the problem.

function rescueERC20(address _token, uint256 _amount) external onlyOwner {
    IERC20(_token).transfer(owner(), _amount);
  }

4. Conclusion

The audited smart contract can be deployed. Only low severity issues were found during security audit.

SerecThunderson commented 3 years ago

Hello, we would like to bring contention to a couple of points:

3.4 Owner privileges This is not a security issue, because the ownership of this contract has already been revoked to a burn address, and cannot be redeemed. https://etherscan.io/token/0x236d53148f83706c3d670064809577385f923a75

3.2. Function includeAccount() waste a Gas and has a risk of OUT_OF_GAS exception. This is not a gas issue, because the function is only inefficient when the list of excluded accounts is large. Because there is no, and never will be, an owner to add accounts to the excluded list, this can never grow to be a gas issue.

We understand the reasonings for the judgements, and also agree with and understand the rest of the audit in entirety. But it is important that the issues above be addressed, please.

yuriy77k commented 3 years ago

@SerecThunderson thank you for your notice. The report was updated.

yuriy77k commented 3 years ago

Blog post: https://callisto.network/shusky-security-audit/

Twitter: https://twitter.com/Callisto_Audits/status/1396163989986545665

Twitter FR: https://twitter.com/CallistoNetFr/status/1396163982059315203

Twitter RU: https://twitter.com/CallistoNetRu/status/1396163974270439424