This document is a security audit report performed by RideSolo, where OPNPlatform project has been reviewed.
- Crowdsale.sol github commit hash 5cfd2fc9b3642cf2a20a95b51dc2a0497f939519.
- Escrow.sol github commit hash 5cfd2fc9b3642cf2a20a95b51dc2a0497f939519.
- TimeLock.sol github commit hash 51d4bffb4c109e2a6a1c11a383e57724b1625d7e.
- Token.sol github commit hash d2b3b15e9f5cfebc3d2825151fc9220581f2e7ed.
10 issues were reported including:
-
1 medium severity issues.
-
7 low severity issues.
-
2 minor remark.
Before adding tokens to user balance using addTokens function member of TokenTimeLock contract, a condition should be added where the token balance of the contract has to be sufficient to pay the users.
To compute tokens that a user bought, the _weiAmount in _getTokenAmount is first divided by tokenPriceInWei then multiplied by 10**decimals (1 ether in the contract).
If the devs intention was to set a minimum buy threshold of tokenPriceInWei or a multiple of it, this operation can be considered as correct.
Stages of the Crowdsale contract are set after deploying the contract, additional stages can be added while the ICO has started extending the ICO phase. investors have to be informed.
Sufficient balance has to be available to execute oraclize queries, if the contract owner call withdrawBalance() and empty the contract balance, oraclize callback won't execute the required query to update the exchange rate using updatePrice.
This issue does not represent a risk since updatePrice can be called manually.
updatePriceis payable,msg.valueshould be added tooraclizeBalance, same as inaddBalanceForOraclize.- When
withdrawBalance()is called the remaining contract balance should be equal tooraclizeBalance. - At each call of
updatePrice, the query price has to be deducted fromoraclizeBalance.
If a user sends ether to the escrow contract using multiple transactions and a manager call getETH between two ethers transfer, startBalance will be set to the previous contract balance value making the withdrawal stages applicable only for that value.
to withdraw the ether left in the contract either the owner has to call transferETH or the manager has to wait untill stopDay is reached.
pause function member of Pausable contract can still be called even after ICO end (following the contracts logic the pause mechanism is used to prevent token trading while the ICO is ongoing), therefore pausing the token transfer.
https://github.com/OPNAG/contracts/blob/51d4bffb4c109e2a6a1c11a383e57724b1625d7e/Token.sol#L119
The devs should consider to implement a mechanism where this procedure is automated to protecet the token contract from any possible issue like hack of owner private key.
Multiple declaration of delOwner member of Escrow. replace the fundtion name with delManager.
The Crowdsale contract constructor should be payable in order to successfully execute updatePrice inside the constructor and update the exchange rate.
ICOAddress is not set in the contract constructor of Ownable contract. however, the address can be set using setICOAddress.
https://github.com/OPNAG/contracts/blob/51d4bffb4c109e2a6a1c11a383e57724b1625d7e/Token.sol#L55
ERC20 Tokens have some well-known issues (listed bellow), This is just a reminder for the contract developers.
- Approve + transferFrom mechanism allows double Withdrawal attack (use
increaseApprovalordecreaseApprovalto change the allowance value). - Lack of transaction handling.
The above mentioned issues are well documented, a basic search can help to get more information.
The audited smart contracts do not contain any high severity issues, however the above described issues have to be taken into consideration to avoid any possible error or misunderstanding with the investors.