TokenTrader.md

TokenTrader audit report.

Summary

This is the report from a security audit performed on TokenTrader by MrCrambo.

The audit focused primarily on the security of TokenTrader smart contracts.

In scope

1. https://github.com/bokkypoobah/TokenTrader/blob/master/contracts/TestERC20Token.sol
2. https://github.com/bokkypoobah/TokenTrader/blob/master/contracts/TokenSellerFactory.sol
3. https://github.com/bokkypoobah/TokenTrader/blob/master/contracts/TokenTraderFactory.sol

Findings

In total, 3 issues were reported including:

• 0 high severity issues.

• 2 medium severity issues.

• 0 low severity issues.

• 1 minor remark.

Security issues

1. Transfer to zero address at TestERC20Token.sol.

Severity: medium

Description

Tokens could be sent to zero address, that means they will be locked and will not be able to use or burn. Functions transfer and transferFrom.

Recommendation

Need to check if _to address is not zero address.

require(_to != address(0));

2. Double-spend attack is possible.

Severity: medium

Description

In case the user wants to change the approved amount an double-spend attack is possible in TestERC20Token.sol

Recommendation

Can be reviewed here.

3. Fallback function have no usage.

Severity: minor

Description

From version of Solidity 0.4.0 contracts that want to recieve Ether have to implement fallback function with payable modifier. Otherwise it will throw automatically. In files TokenSellerFactory.sol and TokenTraderFactory.sol

Recommendation

Remove fallback function or add payable modifier.

Conclusion

No critical vulnerabilities were detected,but we highly recommend to complete other bugs before use.