USDC (USD Coin) Security Audit Report

Are Your Funds Safe?

Our expert team at Callisto Network has conducted an in-depth security audit of the USDC (USD Coin) smart contract. This audit aims to ensure the security of your funds by identifying and assessing any potential vulnerabilities. Here, we present our findings:

1
Total Finding(s)
0 - Hight severity issue(s)
0 - Medium severity issue(s)
1 - Low severity issue(s)
0 note(s)
4 owner privilege(s)

Executive Summary

This report presents the results of the security audit conducted by the Callisto Network Security Department on the USDC (USD Coin) smart contract in April 2023. It analyzes the contract’s security in-depth and highlights any identified vulnerabilities.

1. Scope of the Audit

The audit focused on the following USDC contracts:

2. Audit Findings

Our audit reported a total of 1 finding(s), categorized as follows:

  • 0 high-severity issue(s).
  • 0 medium severity issue(s).
  • 1 low-severity issue(s).

In addition to these findings, our audit identified 4 additional points, detailed in the following sections:

  • 0 note(s).
  • 4 owner privilege(s).
No critical security issues were found.

2.1 Known Vulnerabilities of ERC-20 Token

null

Severity:

Low.
null

Description:

The contract lacks a transaction handling mechanism. WARNING! This common vulnerability has already led to significant financial losses. For a comprehensive understanding of this issue, click here.
null

Recommendation:

Add the following code to the transfer(_to address, ...) function:

require( _to != address(this) );

2.2 Upgradeable Contract

null

Severity:

Owner Privileges.
null

Description:

The USDC contract utilizes an upgradeable design, which allows for the implemented code to be overwritten with new code. While this provides flexibility for future improvements, it also introduces the risk of errors being introduced into the contract during an upgrade.

2.3 Blacklist System

null

Severity:

Owner Privileges.
null

Description:

The USDC token adheres to a strict set of terms of use, which includes a blacklist system. An account that is blacklisted cannot send or receive USDC tokens. This mechanism is in place to ensure compliance with regulatory requirements and mitigate risks associated with illicit activities.

2.4 Multiple Minters

null

Severity:

Owner Privileges.
null

Description:

The USDC contract has the capability to support multiple minters. This feature provides greater flexibility in managing the token’s supply. However, it also introduces potential risks if one minter becomes compromised. Maintaining strict control over the minters is essential to minimize potential security risks.

2.5 Pauseable Contract

null

Severity:

Owner Privileges.
null

Description:

The USDC contract includes a pausable feature, allowing the token’s operations to be halted in case of an emergency, such as a de-pegging event. This functionality can help protect user funds and prevent further damage in the event of a severe issue. However, it also centralizes control over the token’s operations, which may be a point of concern for some users.

3. Security Practices

4. Conclusion

The USDC token is a well-established stablecoin with a robust design. However, it is important for users to be aware of the potential risks associated with its upgradeable, blacklist, multiple minter, and pausable features. It is highly recommended to closely monitor any upgrades to the contract and stay informed about changes in the blacklist policy to ensure the continued security and stability of the token.

5. Revealing Audit Reports

About Callisto Network

Founded by Dexaran,  co-founder of Ethereum Classic, Callisto Network is a blockchain platform that prioritizes security. We’ve conducted over 330 smart contract audits across platforms like Ethereum, Ethereum Classic, and EOS. In addition to our audits, we’ve developed the ERC 223 token standard and CallistoNFT standard, enhancements over existing standards that address flaws and offer new capabilities, further establishing us as industry leaders in crypto-security.

Trust The Blockchain, Audit Your Smart Contracts.