Maker Token (MKR) security audit, conducted by the Callisto Network Security Department in March 2019.
Maker Token (MKR) Specificities
Audit Request
Audit Top 200 CoinMarketCap tokens.
Symbol : MKR
Name : Maker
Circulating supply: 1 000 000
Total supply: 1 000 000
Max supply: No data
Deployed at:
https://etherscan.io/address/0x9f8f72aa9304c8b593d555f12ef6589cc3a579a2#code
Source Code:
https://gist.github.com/yuriy77k/527895b7b7a1c00c867970cc9450aa60
Disclosure polic:
Public.
Platform:
ETH.
Number of lines:
236.
Maker Token (MKR) Smart Contract Security Audit Report
Are Your Funds Safe?
1. In scope
2. Findings
In total, 5 issues were reported including:
-
5 low severity issues.
No critical security issues were found.
2.1. Known vulnerabilities of ERC-20 token
Severity: low.
Description:
- It is possible to double withdrawal attack. More details here.
- Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here.
Recommendation!
Add the following code to the
transfer(_to address, ...)
function:
require( _to != address(this) );
2.2. ERC20 Compliance — event missing
Severity: low.
Code snippet:
Description:
- According to ERC20 standard when coins are minted a
Transfer
event should be emitted. - The
burn
function also should emit theTransfer
event.
2.3. It is necessary to check the input address of transfer
function
Severity: low.
Code snippet:
Description:
- In the
transfer
andtransferFrom
functions, input destination address is not checked for a null value and the funds can be transferred to a0x0
-address. - Also it is needed to check input address for
setOwner
andsetAuthority
function.
2.4. Default approve
value
Severity: low.
Code snippet:
Description:
In case if the approve
function is called with only “beneficiary” address parameter then max-uint value(!) of token will be approved to recipient.
Also the approved value doesn’t decrease when trnsferFrom
called in case of max-uint approved value. It is some sort of ERC20 discrepancy.
2.5. Owner’s Privileges
Severity: low.
Code snippet:
Description:
The contract owner allow himself to pause functions of contract (transfer
, transferFrom
, approve
, mint
, burn
).
3. Conclusion
The audited smart contract can be deployed. Only low severity issues were found during the audit.
4. Revealing audit reports
- https://gist.github.com/yuriy77k/02f341422e1fef9497e952914df2094f
- https://gist.github.com/yuriy77k/d79699c49391902276555b5c731c8ead
- https://gist.github.com/yuriy77k/1a7589c329e88736d9066effde0fc902
Appendix
Smart Contract Audits by Callisto Network.
Miscellaneous
Our Most Popular Audit Reports.
Trust the Blockchain, Audit the Smart Contracts.
Follow Callisto’s Security Department on Twitter to get our latest news and updates!