Improved Gigzi contracts security audit report.

ETH_ImprovedGigziContracts_audit_report.md

Improved Gigzi smart contracts security audit report

Summary

This is the report from a security audit performed on Gigzi by gorbunovperm.

The smart contract allows the Central Authority (CA) to issue tokens backed by precious metals.

In scope

1. FeeableToken.sol
2. GigBlack.sol
3. GigCrowdsale.sol
4. GigGold.sol
5. GigPlatinum.sol
6. GigSilver.sol
7. Migrations.sol

Findings

In total, 3 issues were reported including:

• 0 high severity issue.

• 1 medium severity issues.

• 1 low severity issues.

• 1 minor observations.

Security issues

Issues for GigBlack.sol

1. Known ERC-20 vulnerabilities

Severity: medium

Code snippet

function approve(address _spender, uint256 _value) public returns (bool) {
  allowed[msg.sender][_spender] = _value;
  emit Approval(msg.sender, _spender, _value);
  return true;
}

Description

Changing an allowance with this method brings the risk that someone may use both the old and the new allowance by unfortunate transaction ordering.

Recommendation

One possible solution to mitigate this race condition is to first reduce the spender's allowance to 0 and set the desired value afterwards: ethereum/EIPs#20 (comment)

2. processTransfer always returns false

Severity: low

Code snippet

function processTransfer(address _from, address _to, uint256 _value) internal returns (bool) {

    // update rewards before transfer
    updateAccountReward          (_from);
    updateAccountReward          (_to);

    FeeableToken.processTransfer (_from, _to, _value);
}

Description

processTransfer function of GigBlack contract calls override and call parent function of FeedableToken contract. Parent function returns true, but GigBlack processTransfer doesn't have a return keyword and by default always return false. This can distort the logic of the application.

Recommendation

Use return FeeableToken.processTransfer (_from, _to, _value); for right result.

3. It will be good to prevent possible overflow.

Severity: minor observation

Code snippet

Several places in code. Just example:

accInfo.rewardAccum = prevAccum + balanceOf(accInfo.accountAddress) * rewardPeriod;

Description

It will be good to prevent possible overflow.

Recommendation

Use SafeMath library functions.

Conclusion

Serious vulnerabilities in the contract were not found.