Proaudit Btcnext

Smart Contract Security Audit

Disclaimer

This is a limited report on our findings based on our analysis, in accordance with good industry practice as at the date of this report, in relation to cybersecurity vulnerabilities and issues in the framework and algorithms based on smart contracts, the details of which are set out in this report. In order to get a full view of our analysis, it is crucial for you to read the full report. While we have done our best in conducting our analysis and producing this report, it is important to note that you should not rely on this report and cannot claim against us on the basis of what it says or doesn’t say, or how we produced it, and it is important for you to conduct your own independent investigations before making any decisions. We go into more detail on this in the below disclaimer below – please make sure to read it in full.

Disclaimer:

By reading this report or any part of it, you agree to the terms of this disclaimer. If you do not agree to the terms, then please immediately cease reading this report, and delete and destroy any and all copies of this report downloaded and/or printed by you. This report is provided for information purposes only and on a non-reliance basis, and does not constitute investment advice. No one shall have any right to rely on the report or its contents, and ProAudit and its affiliates (including holding companies, shareholders, subsidiaries, employees, directors, officers and other representatives) (ProAudit) owe no duty of care towards you or any other person, nor does ProAudit make any warranty or representation to any person on the accuracy or completeness of the report. The report is provided "as is", without any conditions, warranties or other terms of any kind except as set out in this disclaimer, and ProAudit hereby excludes all representations, warranties, conditions and other terms (including, without limitation, the warranties implied by law of satisfactory quality, fitness for purpose and the use of reasonable care and skill) which, but for this clause, might have effect in relation to the report. Except and only to the extent that it is prohibited by law, ProAudit hereby excludes all liability and responsibility, and neither you nor any other person shall have any claim against ProAudit, for any amount or kind of loss or damage that may result to you or any other person (including without limitation, any direct, indirect, special, punitive, consequential or pure economic loss or damages, or any loss of income, profits, goodwill, data, contracts, use of money, or business interruption, and whether in delict, tort (including without limitation negligence), contract, breach of statutory duty, misrepresentation (whether innocent or negligent) or otherwise under any claim of any nature whatsoever in any jurisdiction) in any way arising from or connected with this report and the use, inability to use or the results of use of this report, and any reliance on this report.
The analysis of the security is purely based on the smart contracts alone. No applications or operations were reviewed for security. No product code has been reviewed.

Background

TechRate was commissioned to perform an audit of smart contracts:

The audit was conducted between 3 June 2019 and 4 June 2019.

The purpose of the audit was to achieve the following:

  • Ensure that the smart contract functions as intended.
  • Identify potential security issues with the smart contract.

The information in this report should be used to understand the risk exposure of the smart contract, and as a guide to improve the security posture of the smart contract by remediating the issues that were identified.

High Severity Issues

High Severity Issues

Medium Severity Issues

No Medium Severity Issues

Low Severity Issues

1. Known vulnerabilities of ERC-20 token

Issue:

  • It is possible to double withdrawal attack. More details here.
  • Lack of transaction handling mechanism issue. More details here.

Recommendation:

  • Add into the function function transfer(address _to, uint256 _value) following code: require(_to != address(this));

2. Extra conditions

Issue:

  • There are extra checking in functions _burn in line 445, transferFrom in lines 274 and 275, transfer in line 194. This conditions will be automatically checked by SafeMath library.

Recommendation:

  • This lines could be removed.

Conclusion

Smart contract contains only low severity issues.