SMART CONTRACT CODEREVIEW AND SECURITY
ANALYSIS REPORTCustomer​:
Prepared on​:Platform:
Language:

info@rdauditors.com

Crypto Blades
26/03/2021
BinanceSolidity

Table of contentsDocument

3

Introduction

4

Project Scope

4

Executive Summary

5

Code Quality

6

Documentation

6

Use of Dependencies

7

AS-IS overview

7

Severity Definitions

10

Audit Findings

11

Conclusion

12

Our Methodology

13

Disclaimers

15

info@rdauditors.com

THIS DOCUMENT MAY CONTAIN CONFIDENTIAL INFORMATION ABOUT ITSSYSTEMS AND INTELLECTUAL PROPERTY OF THE CUSTOMER AS WELL AS
INFORMATION ABOUT POTENTIAL VULNERABILITIES AND METHODS OFTHEIR EXPLOITATION.
THE REPORT CONTAINING CONFIDENTIAL INFORMATION CAN BE USEDINTERNALLY BY THE CUSTOMER OR IT CAN BE DISCLOSED PUBLICLY
AFTER ALL VULNERABILITIES ARE FIXED - UPON DECISION OF CUSTOMER.

Document
Name

Smart Contract Code Review and Security Analysis
Report for Crypto Blades

Platform

Binance/Solidity

File

CoinToken.sol

MD5 hash

BDF1187CAC09A73C9AB9B51255DC72F9SHA256 hash

17E3FECD08BAD0ED9CFEE4EA1F5D85DAFF212A684616C
B6E0782231F60475DAADate

26/03/2021

info@rdauditors.com

Introduction
RD Auditors (Consultant) was contracted by Crypto Blades (Customer) to conduct a
Smart Contracts Code Review and Security Analysis. This report presents thefindings of the security assessment of Customer`s smart contracts and its code
review conducted between March 25, 2021 – March 26, 2021.
This contract consists of 1 file.

Project Scope
The scope of the project is a smart contract.
We have scanned this smart contract for commonly known and more specificvulnerabilities, below are those considered (the full list includes but not limited to):•••••••••••••••

Reentrancy
Timestamp Dependence
Gas Limit and Loops
DoS with (Unexpected) Throw
DoS with Block Gas Limit
Transaction-Ordering Dependence
Byte array vulnerabilities
Style guide violation
Transfer forwards all gas
ERC20 API violation
Malicious libraries
Compiler version not fixedUnchecked external call - Unchecked mathUnsafe type inference
Implicit visibility level

info@rdauditors.com

Executive Summary
According to the assessment, the customer`s solidity smart contract issecured.

You are here

Automated checks are with smartDec, Mythril, Slither and remix IDE. All
issues were performed by our team, which included the analysis of code
functionality, manual audit found during automated analysis were manuallyreviewed and applicable vulnerabilities are presented in the audit overview
section. The general overview is presented in the AS-IS section and allissues found are located in the audit overview section.
We found 0 critical, 0 high, 0 medium, 0 low and 0 very low level issues.

Code Quality
CoinToken consists of a single smart contract file.This also contains
safeMath, this is a compact and well written contract.
The library in the CoinToken is part of its logical algorithm. A library is adifferent type of smart contract that contains reusable code. Once deployedon the blockchain (only once), it is assigned a specific address and its
properties / methods can be reused many times by other contracts in the
CryptoBladesSkillToken.
The Crypto Blades has not provided scenario and unit test scripts, which
would help to determine the integrity of the code in an automated way.

info@rdauditors.com

Overall, the code is well commented. Commenting can provide richdocumentation for functions, return variables and more. Use of Ethereum
Natural Language Specification Format (NatSpec) for commenting isrecommended.

Documentation
We were given CoinToken in the form of a github link:
https://bscscan.com/address/0x154a9f9cbd3449ad22fdae23044319d6ef2a1
fab#code
The hash of those files are mentioned in the table. As mentioned, It's wellcommented smart contract code, so anyone can quickly understand theprogramming flow as well as complex code logic. Comments are very helpfulin understanding the overall architecture of the protocol. It also provides aclear overview of the system components, including helpful details, like thelifetime of the background script.

Use of Dependencies
Corecodeblocks

are written well and systematically. No otherdependencies except safeMath.

AS-IS overview
CoinToken overview
It is a simple ERC20 token contract.

info@rdauditors.com

File And Function Level Report

Contract: Ownable
Observation: All passed including security check
Test Report: passed
Score: passedConclusion: passedSl.

Function1transfeOwnership

Type Observation

TestReport

Conclusion

Score

All Passed

No IssuePassedType Observation Test Report Conclusion

Scorewritewrite

PassedPassedPassedContract: Pausable
Inherit: ownable
Observation: All passed including security check
Test Report: passed
Score: passed
Conclusion: passedSl.
12Function
Pause
unpauseinfo@rdauditors.com

PassedPassedAll Passed
All Passed

No Issue
No Issue

Contract: ERC20
Inherit: ERC20Basic
Observation: All passed including security check
Test Report: passed
Score: passed
Conclusion: passed

Sl.
12
3

FunctionallowancetransferFrom
approve

Type Observation Test Report Conclusion

Scorewrite
write
write

PassedPassedPassedPassedPassedPassedAll Passed
All Passed
All Passed

No Issue
No Issue
No IssueContract: StandardToken
Inherit: ERC20
Observation: All passed including security check
Test Report: passed
Score: passedConclusion: passed

Sl.

Function

12
3
4
5
6
7
8

transferbalanceOf
transferFrom
approveallowanceincreaseApproval
decreaseApproval_blackList

info@rdauditors.com

Type Observation Test Report Conclusion

Scorewrite
readwrite
write
readwritewritewrite

PassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedAll Passed
All Passed
All Passed
All Passed
All Passed
All Passed
All Passed
All Passed

No Issue
No Issue
No Issue
No Issue
No Issue
No Issue
No Issue
No Issue

Contract: PausableToken
Inherit: standardToken, Pausable
Observation: All passed including security check
Test Report: passed
Score: passed
Conclusion: passed

Sl.

Function

12
3
4
5
6

transfertransferFrom
approveincreaseApproval
decreaseApproval
blackListAddress

Type Observation Test Report Conclusion

Score

write
write
write
writewritewrite

PassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedPassedAll Passed
All Passed
All Passed
All Passed
All Passed
All Passed

No Issue
No Issue
No Issue
No Issue
No Issue
No IssueContract: CoinToken
Inherit: PausableToken
Observation: All passed including security check
Test Report: passed
Score: passed
Conclusion: passed

Sl.
1
2
3

Functionburn_burnmint

info@rdauditors.com

Type Observation Test Report Conclusion

Score

write
write
write

PassedPassedPassedPassed
PassedPassedAll Passed
All Passed
All Passed

No Issue
No Issue
No IssueSeverity Definitions
Risk Level
CriticalHigh

Description
Critical vulnerabilities are usually straightforward toexploit and can lead to tokens loss etc.
High-level vulnerabilities are difficult to exploit;
however, they also have significant impact on smart
contract execution, e.g. public access to crucial
functions

MediumMedium-level vulnerabilities are important to fix;
however, they can’t lead to tokens loseLow

Low-level vulnerabilities are mostly related tooutdated, unused etc. code snippets, that can’t havesignificant impact on execution

Lowest / CodeStyle / Best
Practice

Lowest-level vulnerabilities, code style violations
and info statements can’t affect smart contract
execution and can be ignored.

Audit Findings
CriticalNo critical severity vulnerabilities were found.
High
No high severity vulnerabilities were found.
MediumNo Medium severity vulnerabilities were found.
Low
No Low severity vulnerabilities were found.
Very Low
No very Low severity vulnerabilities were found.

info@rdauditors.com

Discussion:1) In safeMath assert should be replaced by require.
2) The lower compiler version is a little vulnerable to some compiler orientedbugs (like memory overlap on fixed size arrays), which are normally fixed onlater versions. so it is good to use the latest stable version to be on the safe
side.

Conclusion
We were given contract files. And we have used all possible tests based on
the given object. The contracts are written systematically . We found no
critical issues So it is good to go for production.
Since possible test cases can be unlimited and developer level
documentation (code flow diagram with function level description) notprovided, for such an extensive smart contract protocol, so we provide nosuch guarantee of future outcomes. We have used all the latest static tools
and manual observations to cover maximum possible test cases to scan
everything.
Security state of reviewed contract is “secured”.

info@rdauditors.com

Our Methodology
We like to work with a transparent process and make our reviews acollaborative effort. The goals of our security audits are to improve thequality of systems we review and aim for sufficient remediation to help
protect users. The following is the methodology we use in our security
audit process.
Manual Code Review:
In manually reviewing all of the code, we look for any potential issues
withcode logic, error handling, protocol and header parsing,

cryptographic errors, and random number generators. We also watch forareas where more defensive programming could reduce the risk of future
mistakes and speed up future audits. Although our primary focus is on
the in-scope code, we examine dependency code and behavior when it
is relevant to a particular line of investigation.
Vulnerability Analysis:
Our audit techniques included manual code analysis, user interface
interaction, and whitebox penetration testing. We look at the project's
web site to get a high level understanding of what functionality thesoftware under review provides. We then meet with the developers togain an appreciation of their vision of the software. We install and use
the relevant software, exploring the user interactions and roles. While
we do this, we brainstorm threat models and attack surfaces. We readdesign documentation, review other audit results, search for similar
projects, examine source code dependencies, skim open issue
tickets, and generally investigate details other than the implementation.

info@rdauditors.com

Documenting Results:
We follow a conservative, transparent process for analyzing potential
security vulnerabilities and seeing them through successful remediation.
Whenever a potential issue is discovered, we immediately create anIssue entry for it in this document, even though we have not yet verified
the feasibility and impact of the issue. This process is conservative
because we document our suspicions early even if they are later shownto not represent exploitable vulnerabilities. We generally follow a processof first documenting the suspicion with unresolved questions, thenconfirming the issue through code analysis, live experimentation, orautomated tests. Code analysis is the most tentative, and we strive toprovide test code, log captures, or screenshots demonstrating ourconfirmation. After this we analyze the feasibility of an attack in a livesystem.
Suggested Solutions:
We search for immediate mitigations that live deployments can take, andfinally we suggest the requirements for remediation engineering for
future releases. The mitigation and remediation recommendations
should be scrutinized by the developers and deployment engineers, andsuccessful mitigation and remediation is an ongoing collaborative
process after we deliver our report, and before the details are madepublic.

info@rdauditors.com

Disclaimers
RD Auditors Disclaimer
The smart contracts given for audit have been analyzed in accordancewith the best industry practices at the date of this report, in relation to:
cybersecurity vulnerabilities and issues in smart contract source code,
the details of which are disclosed in this report, (Source Code); theSource Code compilation, deployment and functionality (performing theintended functions).
Because the total number of test cases are unlimited, so the audit makes
no statements or warranties on security of the code. It also cannot be
considered as a sufficient assessment regarding the utility and safety of
the code, bugfree status or any other statements of the contract. While
we have done our best in conducting the analysis and producing thisreport, it is important to note that you should not rely on this report only we recommend proceeding with several independent audits and a public
bug bounty program to ensure security of smart contracts.

Technical Disclaimer
Smart contracts are deployed and executed on blockchain platform. The
platform, its programming language, and other software related to thesmart contract can have their own vulnerabilities that can lead to hacks.
Thus, the audit can’t guarantee explicit security of the audited smart
contracts.

info@rdauditors.com

info@rdauditors.com