ETH_bomb3d_audit_report.md

bomb3d audit report.

1. Summary

This document is a security audit report performed by danbogd, where bomb3d has been reviewed.

2. In scope

Сommit hash .

• xxx.sol.

3. Findings

In total, 5 issues were reported including:

• 1 medium severity issues
• 3 low severity issues
• 1 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
• 0 notes.

No critical security issues were found.

3.1. Out of gas.

Severity: medium

Description

There is no upper limit on receivers.length. Eventually, as the length of arrays increases, gas cost of smart contract calls will raise. This can lead to "Out of Gas" error or to "Block Gas Limit".

Code snippet

Line 167

    function multiTransfer(address[] memory receivers, uint256[] memory values) public
    {
    for (uint256 i = 0; i < receivers.length; i++) 
    {
        transfer(receivers[i], values[i]);
    }
    }

3.2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here.

2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

3.3. Multi Transfer arrays length check.

Severity: low

Description

There are two input arrays, but no check for the same length. In this case it is possible to skip some recipient or token amount and to transfer wrong amount to wrong recipient.

Code snippet

Line 167

    function multiTransfer(address[] memory receivers, uint256[] memory values) public
    {
    for (uint256 i = 0; i < receivers.length; i++) 
    {
        transfer(receivers[i], values[i]);
    }
    }

3.4. Decrease Allowance

Severity: low

Description

decreaseAllowance throw in case if the value to be subtracted is higher than the amount that is allowed, if the address owner wants to change the value allowed by reducing it and the spender withdraw a part of it before, the function might throw and give more chances for the spender to take the rest of the allowed value.

The value should be set to zero if the value to be subtracted is higher than the allowance.

Code snippet

Line 215.

    function decreaseAllowance(address spender, uint256 subtractedValue) public returns (bool) 
    {
    require(spender != address(0));
    _allowed[msg.sender][spender] = (_allowed[msg.sender][spender].sub(subtractedValue));
    emit Approval(msg.sender, spender, _allowed[msg.sender][spender]);
    return true;
    }

3.5. Owner Privileges

Severity: owner previliges

Description

Contract owner allow himself to:

• reward owner with additional virtual stake from a capped pool.

Line: 404.

    function setStakingBonus(address staker, uint256 value) public
    {
    require(msg.sender == admin);
    updateRewardsFor(staker);
    totalAmountStaked_bonuses = totalAmountStaked_bonuses.sub(_stakedBalances_bonuses[staker]);
    _stakedBalances_bonuses[staker] = value;
    totalAmountStaked_bonuses = totalAmountStaked_bonuses.add(value);
    require(totalAmountStaked_bonuses <= stakingBonuses_max);
    }

4. Conclusion

The review did not show any critical issues, some of medium and low severity issues were found.