This document is a security audit report performed by danbogd, where SafeUpgradeableTokenERC20 has been reviewed.
Сommit hash a755f5ee08e2612b62d36652f626a74a26f34d37.
In total, 4 issues were reported including:
- 1 medium severity issues
- 0 low severity issues
- 3 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
- 0 notes.
No critical security issues were found.
Following ERC-20 final description:
"NOTE: To prevent attack vectors like the one described here and discussed here, clients SHOULD make sure to create user interfaces in such a way that they set the allowance first to 0 before setting it to another value for the same spender. THOUGH The contract itself shouldn't enforce it, to allow backwards compatibility with contracts deployed before.
Do not throw in case if the following condition is true require((value == 0) || (_allowances[msg.sender][spender] == 0)) and return false, users might not notice that the changes didn't occur, and external contract calls to this function will highlight many other issues.
-
The contract owner allow himself to pause functions of contract (transfer, transferFrom, approve, increaseAllowance, decreaseAllowance) here.
-
Owner can upgrade contract and implement any logic in the new contract. And even if the new contract will be audited, at any time possible to change the address of the new contract again to not audited and insecure here.
-
Evacuate Tokens at any time here.
The review did not show any critical issues, some of medium and low severity issues were found.