ETH_Airswap_report.md

Summary

This is the report from a security audit performed on Airswap by MrCrambo.

The audit focused primarily on the security of Airswap smart contracts.

In scope

1. https://github.com/airswap/contracts/blob/master/contracts/AirSwapToken.sol
2. https://github.com/airswap/contracts/blob/master/contracts/Exchange.sol

Findings

In total, 3 issues were reported including:

• 0 high severity issues.

• 0 medium severity issues.

• 0 owner privilegies issues.

• 3 low severity issues.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

1. It is possible to double withdrawal attack. More details here
2. Lack of transaction handling mechanism issue. More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. Use throw

Severity: low

Description

In function fill use throw instead of returning and emitting failed event, because other contracts which use exchange smart contract will not know, that its failed.

3. Zero address checking

Severity: low

Description

There is no zero address checking in AirSwapToken

Conclusion

Smart contract contains low severity issues.