Hydrogen_Snowflake_audit_report.md

Hydrogen Snowflake audit report.

1. Summary

This document is a security audit report performed by danbogd, where Hydrogen Snowflake has been reviewed.

2. In scope

• Snowflake.sol github commit hash 90389befae1fcbca015f1257bf9d5ac5eccd302a.

3. Findings

In total, 4 issues were reported including:

• 1 medium severity issues.
• 3 low severity issues.

No critical security issues were found.

3.1. Gas limit and loops

Severity: medium

Description

There is no upper limit on providers, it increments each time a new transaction is registered. Eventually, as the count of transactions increases, gas cost of smart contract calls will raise. If providers.length is large enough, the function exceeds the block gas limit, and transactions calling it will never be confirmed.

Code snippet

https://github.com/HydroBlockchain/smart-contracts/blob/90389befae1fcbca015f1257bf9d5ac5eccd302a/snowflake/contracts/Snowflake.sol#L75

3.2. Non-initialized return value

Severity: low

Description

There is no return statement in this function that means that it always returns false by default. And this can break the logic of the Dapp.

Code snippet

https://github.com/HydroBlockchain/smart-contracts/blob/90389befae1fcbca015f1257bf9d5ac5eccd302a/snowflake/contracts/Snowflake.sol#L440-L446

Recommendation

Add return statement with the right expression.

3.3. Owner Privileges (the relocating is not secure process for investors).

Severity: low

Description

The owners can implement any logic in the new contract. And even if the new contract will be audited, at any time possible to change the address of the new contract again to not audited and insecure.

Code snippet

https://github.com/HydroBlockchain/smart-contracts/blob/90389befae1fcbca015f1257bf9d5ac5eccd302a/snowflake/contracts/Snowflake.sol#L53-L59

3.4. It is necessary to check the input address to the zero-address.

Severity: low

Description

In the setAddresses function, the input address of _hydroTokenAddress is not checked for a null value and the funds can be accidentally transferred to a 0x0-address.

###Code snippet

https://github.com/HydroBlockchain/smart-contracts/blob/90389befae1fcbca015f1257bf9d5ac5eccd302a/snowflake/contracts/Snowflake.sol#L53-L59

4. Conclusion

Medium issues can influence smart contracts operation in current implementation. We highly recommend addressing them.