Our expert team at Callisto Network has conducted an in-depth security audit of the Worthpad smart contract. This audit aims to ensure the security of your funds by identifying and assessing any potential vulnerabilities. Here, we present our findings:
0 - Hight severity issue(s)
0 - Medium severity issue(s)
1 - Low severity issue(s)
8 owner privilege(s)
This report presents the results of the security audit conducted by the Callisto Network Security Department on the Worthpadsmart contract in December 2021. It analyzes the contract’s security in-depth and highlights any identified vulnerabilities.
OpenZeppelin standard imports were excluded from the audit.
2. Audit Findings
Our audit reported a total of 1 finding(s), categorized as follows:
0 high-severity issue(s).
0 medium severity issue(s).
1 low-severity issue(s).
In addition to these findings, our audit identified 10 additional points, detailed in the following sections:
8 owner privilege(s).
No critical security issues were found.
2.1 Owner Privileges
WorthToken contract owner has rights to:
Exclude/include any account from/in the fee.
Set Worth DVC Fund fee percentage in the 1% – 10% range.
Set liquidity fee percentage in the 1% – 10% range.
Change the maximal amount per transaction from 0 to 100,000,000 tokens.
Enable or disable adding liquidity to the pool using the function setSwapAndLiquifyEnabled.
WorthTokenSale contract owner has rights to:
Add users to the whitelist and set the maximum allocation amount (in USD).
Close tokens sale calling functionendSale(). Without ending the sale, users could not claim bought tokens.
Withdraw all tokens from the contract using the function withdrawTokens including unclaimed users tokens.
2.2 allDepositIds is not necessary
The allDepositIds array contains a sequence of id from 1 to depositId. So all deposits Ids are below or equal to depositId.
2.3 The Hard cap may be exceeded
The Hard cap is checked before adding the amount the user sends to exchangeUSDTForToken and exchangeBUSDForToken. It may cause exceed the Hard cap if a user sends a bigger amount than left to reach the hard cap.
2.4 The owner can withdraw the user’s unclaimed tokens
The function withdrawTokens allows the contract owner to withdraw the entire balance of the contract, including tokens that users bought but did not claim yet.
3. Security Practices
The audited smart contract can be deployed. Only low severity issues were found during the audit.
Pay attention to WorthTokenSale contract owner rights that may hurt users.
It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract’s operability and prevent any issues that are not directly related to the code of this smart contract.
About Callisto Network
Founded by Dexaran, co-founder of Ethereum Classic, Callisto Network is a blockchain platform that prioritizes security. We’ve conducted over 330 smart contract audits across platforms like Ethereum, Ethereum Classic, and EOS. In addition to our audits, we’ve developed the ERC 223 token standard and CallistoNFT standard, enhancements over existing standards that address flaws and offer new capabilities, further establishing us as industry leaders in crypto-security.