ETH_SafeUpgradeableTokenERC20_report.md

Safe Upgradeable Token Audit Report.

1. Summary

This document is a security audit report performed by RideSolo, where SafeUpgradeableTokenERC20 has been reviewed.

2. In scope

• SafeUpgradeableTokenERC20.sol github commit hash 8bfb49766d967009a680548ef3cc28c011aa1c4c.

3. Findings

3 issues were reported:

• 2 low severity issues.
• 1 owner privilege.

3.1. Allowance Approval

Severity: low

Description

Following ERC20 standard, approve function "Allows _spender to withdraw from your account multiple times, up to the _value amount. If this function is called again it overwrites the current allowance with _value.", However the implemented function throw in case if allowed[msg.sender][_spender] is different than zero or _value different than zero. This partialy solve double withdrawal attack but create incompatibility for some Dapps and do not allow the user to directly reduce the allowance creating a race betweenn user and spender.

Code snippet

https://github.com/RideSolo/EthereumSmartContracts/blob/master/SafeUpgradeableTokenERC20/contracts/SafeUpgradeableTokenERC20.sol#L217#LL229

3.2. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

3.3. Owner Privilege

Severity: low

Description

The token owner allow himself to:

• Pause/unpause tokens transfers / transferFrom / allowance allocation and approvals

Code snippet

https://github.com/RideSolo/EthereumSmartContracts/blob/master/SafeUpgradeableTokenERC20/contracts/SafeUpgradeableTokenERC20.sol#L505#L524

Conclusion

The audited contract can be deployed.