airswap security audit report

ETH_airswap_report.md

airswap security audit report

Summary

This is the report from a security audit performed on airswap by gorbunovperm.

Buy and sell tokens simply, securely, and without trading fees.

https://www.airswap.io/

In scope

Commit hash: 04b71ad419ef645e8bd9b50e9998819b7a450616

1. AirSwapToken.sol
2. Exchange.sol
3. Migrations.sol

Findings

In total, 3 issues were reported including:

• 0 critical severity issue.

• 0 high severity issue.

• 0 medium severity issues.

• 2 low severity issues.

• 1 owner privileges.

• 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

• It is possible to double withdrawal attack. More details here

• Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. Owner Privileges

Severity: owner privileges

Description

The contract owner allowed to pause transfer functions (transfer, transferFrom).

Code snippet

• pause transfer
• pause transferFrom

3. No checking for zero address

Severity: low

Description

There is possible to send all the funds and transfer ownership to 0x0-address.

Code snippet

• constructor

Conclusion

There are some vulnerabilities were discovered in these contracts.