Huobi Token (HT) security audit, conducted by the Callisto Network Security Department in July 2019.
Huobi Token (HT) Specificities
Audit Request
Audit Top 200 CoinMarketCap tokens.
Symbol : HT
Name : Huobi
Deployed at:
https://etherscan.io/address/0x6f259637dcd74c767781e37bc6133cd6a68aa161#contracts
Source Code:
https://etherscan.io/address/0x6f259637dcd74c767781e37bc6133cd6a68aa161#contracts
Disclosure policy
Public.
Platform:
ETH.
Number of lines:
78.
Huobi Token (HT) Smart Contract Security Audit Report
Are Your Funds Safe?
1. In scope
2. Findings
In total, 3 issues were reported including:
- 1 medium severity issues.
-
2 low severity issues.
2.1. Known vulnerabilities of ERC-20 token
Severity: low.
Description:
- It is possible to double withdrawal attack. More details here
- Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.
Recommendation:
Add the following code to the
transfer(_to address, ...)
function:
require( _to != address(this) );
2.2. ERC20 Compliance: false
instead of throw
Severity: medium.
Description:
From ERC-20 specification:
The function SHOULD throw
if the _from
account balance does not have enough tokens to spend.
But in this implementation it just returns false
. This can lead to serious consequences. Because checking the return value of this function is rare.
For example, external contract may use this token contract as:
HTToken.transferFrom(recipient, this, value);
points[recipient] += value;
In this case recipient can get any value of points, but he may not have enough money and the code will succeed.
Code snippet:
transfer()
, line 53transferFrom()
, line 63
Recommendation
The function SHOULD
throw
if the_from
account balance does not have enough tokens to spend.
2.3. Zero address checking
Severity: low.
Description:
There is no zero address checking in functions transfer
and transferFrom
.
3. Conclusion
The audited smart contract has medium severity issue and can not be deployed. Reported issues must be fixed prior to the usage of this contract.
4. Revealing audit reports
- https://gist.github.com/yuriy77k/e0fe9298cf3330928d79d241f1b196a5
- https://gist.github.com/yuriy77k/6e75d4bf6a55db266359de2c77781ce5
- https://gist.github.com/yuriy77k/cc9231e2b5ad610bc2bc197971184868
Appendix
Smart Contract Audits by Callisto Network.
Miscellaneous
Our Most Popular Audit Reports.
Trust the Blockchain, Audit the Smart Contracts.
Follow Callisto’s Security Department on Twitter to get our latest news and updates!