Maker Token (MKR) security audit, conducted by the Callisto Network Security Department in March 2019.

 

Maker Token (MKR) Specificities

 

 

 

Audit Request

Audit Top 200 CoinMarketCap tokens.

Symbol      : MKR
Name        : Maker
Circulating supply: 1 000 000
Total supply: 1 000 000
Max supply: No data

https://makerdao.com/

Deployed at:

https://etherscan.io/address/0x9f8f72aa9304c8b593d555f12ef6589cc3a579a2#code

Source Code:

https://gist.github.com/yuriy77k/527895b7b7a1c00c867970cc9450aa60

Disclosure polic:

Public.

Platform:

ETH.

Number of lines:

236.

 

Maker Token (MKR) Smart Contract Security Audit Report

Are Your Funds Safe?

 

1. In scope

2. Findings

In total, 5 issues were reported including:

  • 5 low severity issues.

No critical security issues were found.

2.1. Known vulnerabilities of ERC-20 token

Severity: low.

Description:

  • It is possible to double withdrawal attack. More details here.
  • Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.

Recommendation!

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );

2.2. ERC20 Compliance — event missing

Severity: low.

Code snippet:

Description:

  • According to ERC20 standard when coins are minted a Transfer event should be emitted.
  • The burn function also should emit the Transfer event.

2.3. It is necessary to check the input address of transfer function

Severity: low.

Code snippet:

Description:

  • In the transfer and transferFrom functions, input destination address is not checked for a null value and the funds can be transferred to a 0x0-address.
  • Also it is needed to check input address for setOwner and setAuthority function.

2.4. Default approve value

Severity: low.

Code snippet:

Description:

In case if the approve function is called with only “beneficiary” address parameter then max-uint value(!) of token will be approved to recipient.

Also the approved value doesn’t decrease when trnsferFrom called in case of max-uint approved value. It is some sort of ERC20 discrepancy.

2.5. Owner’s Privileges

Severity: low.

Code snippet:

Description:

The contract owner allow himself to pause functions of contract (transfer, transferFrom, approve, mint, burn).

3. Conclusion

The audited smart contract can be deployed. Only low severity issues were found during the audit.

4. Revealing audit reports

Appendix

Smart Contract Audits by Callisto Network.

Miscellaneous

Why Audit Smart Contracts?

Our Most Popular Audit Reports.

Trust the Blockchain, Audit the Smart Contracts.

Follow Callisto’s Security Department on Twitter to get our latest news and updates!