Our Robust Process and OxyCoin Audit Report

Our Robust Process and OxyCoin Audit Report

Our Robust Process and OxyCoin Audit Report

Our Robust Process and OxyCoin Audit Report

Our Robust Process and OxyCoin Audit Report

Read Time: 2 minutes

We’ve been asked by the Oxycoin team to review and audit their new token code. Here is their unaudited token contract code. We looked at their contract and now publishing our results.

Before writing the results let me tell you in brief about our process of auditing smart contracts. At quillhash , we follow a strategy of verification and validation testing. In verification testing, we perform lots of unit test cases on smart contracts along with the manual testing on every line of the smart contract. After that, we use some automated tools like oyente,mythril,manticore etc to perform several vulnerable attacks on smart contracts.

In the Validation testing phase, we deploy the contract on the ropsten or rinkeby network and ask our team members to use the smart contract for 2,3 days. According to the results of verification and validation testing, we prepare the final audit report.

Now let come back to oxycoin.

The contract of oxycoin was a simple ERC20 token. However, it was not secure at all. Here are our assessment and recommendations, in order of importance:

High vulnerability issues:-

Integer overflow and underflow:- There are many places where they are not using safe math operations which were highly unsafe.

Arguments checking:- In many functions, they were not checking the function arguments with requiring statements, which allows us to pass negative values in functions like mintTokens() functions.

Medium severity issues:-

Short address attack:- Modifier to check short addresses were not there in the contract.

Arguments checking:- In many functions they were not checking the arguments with require statements which were not directly damaging to contract but that can lead to unnecessary wastage of gas if any user passes some wrong value by mistake.

Low severity issues:-

1. Solidity version should be fixed in smart contracts. For ex:- It should be
pragma solidity 0.4.24 and not pragma solidity ^0.4.24

Final comments:-

Contract should be properly commented. It is not commented at all now. It is advised to comment the code as it is good practice.
Function arguments must be checked with require statement in every function.
SafeMath library functions should be used in every mathematical operation.
. In total supply function _totalSupply. sub(balances[address(0)]); ,the
highlighted sub-operation is unnecessary it can be safely removed.
You can check the unaudited and audited code along with the report in the following github repo.(https://github.com/Quillhash/oxycoin).

Conclusion:-
Very severe security issues were found. Many changes were recommended to follow best practices and reduce the potential attack surface.

We’re available for smart contract development and security auditing work. You can fill this form https://quillhash.typeform.com/to/KQ5Hhm to get in touch.

Thanks for reading. Also, do check out our earlier blog posts.


At QuillHash, we understand the Potential of Blockchain and have a good team of developers who can develop any blockchain applications like Smart Contracts, dApps,Smart Coins, DeFi, DEX on the any Blockchain Platform like Ethereum, EOS and Hyperledger.

To be up to date with our work, Join Our Community :-

Telegram | Twitter | Facebook | LinkedIn

2,956 Views

Blockchain for dog nose wrinkles' Ponzi makes off ~$127M🐶

Project promised up to 150% returns on investment in 100 days, raising about 166.4 billion South Korean won — or about $127 million — from 22,000 people.

Latest blogs for this week

Understanding Fuzzing and Fuzz Testing: A Vital Tool in Web3 Security

Read Time: 5 minutes When it comes to smart contracts, ensuring the robustness and security of code is paramount. Many techniques are employed to safeguard these contracts against vulnerabilities
Read More

How EigenLayer’s Restaking Enhances Security and Rewards in DeFi

Read Time: 7 minutes Decentralized finance (DeFi) relies on Ethereum staking to secure the blockchain and maintain consensus. Restaking allows liquid staking tokens to be staked with validators in
Read More

ERC 404 Standard: Everything You Need to Know

Read Time: 7 minutes Introduction Ethereum has significantly shaped the crypto world with its introduction of smart contracts and decentralized applications (DApps). This has led to innovative developments in
Read More

DNS Attacks:  Cascading Effects and Mitigation Strategies

Read Time: 8 minutes Introduction DNS security is vital for a safe online space. DNS translates domain names to IP addresses, crucial for internet functionality. DNS ensures unique name-value
Read More

EIP-4844 Explained: The Key to Ethereum’s Scalability with Protodanksharding

Read Time: 7 minutes Introduction  Ethereum, the driving force behind dApps, has struggled with scalability. High fees and slow processing have limited its potential. They have kept it from
Read More

QuillAudits Powers Supermoon at ETH Denver!

Read Time: 4 minutes Calling all the brightest minds and leaders in the crypto world! Are you ready to build, connect, and innovate at the hottest event during ETH
Read More

Decoding the Role of Artificial Intelligence in Metaverse and Web3

Read Time: 7 minutes Introduction  Experts predict a transformative shift in global software, driven by AI and ML, marking the dawn of a new era. PwC predicts AI will
Read More

Transforming Assets: Unlocking Real-World Asset Tokenization

Read Time: 7 minutes In the blockchain, real-world assets (RWAs) are digital tokens that stand for tangible and conventional financial assets, including money, raw materials, stocks, and bonds. As
Read More
Scroll to Top

Become a Quiffiliate!
Join our mission to safeguard web3

Sounds Interesting, Right? All you have to do is:

1

Refer QuillAudits to Web3 projects for audits.

2

Earn rewards as we conclude the audits.

3

Thereby help us Secure web3 ecosystem.

Total Rewards Shared Out: $200K+