Penetration Test Report (Hacken): YFD Audit Report 211220

SMART CONTRACT CODE
REVIEW AND SECURITY
ANALYSIS REPORT
Customer: YFD
Date: December 21th, 2020
This document may contain confidential information about IT systems and the
intellectual property of the Customer and information about potential
vulnerabilities and methods of their exploitation.
The report containing confidential information can be used internally by the
Customer, or it can be disclosed publicly after all vulnerabilities fixed - upon a
decision of the Customer.
Document
Name Smart Contract Code Review and Security Analysis Report for YFD (10 pages)
Approved by Andrew Matiukhin | CTO Hacken OU
Type Token
Platform Ethereum / Solidity
Methods Architecture Review, Functional Testing, Computer-Aided Verification,
Manual Review
Address 0X4F4F0EF7978737CE928BFF395529161B44E27AD9
Timeline 20TH DEC 2020 – 21TH DEC 2020
Changelog 21TH DEC 2020 - Initial Audit
Table of contents
Document................................................................................................................................... 2
Table of contents ....................................................................................................................... 3
Introduction ............................................................................................................................... 4
Scope .......................................................................................................................................... 4
Executive Summary .................................................................................................................... 5
Severity Definitions .................................................................................................................... 6
AS-IS overview............................................................................................................................ 7
Conclusion .................................................................................................................................. 9
Disclaimers ............................................................................................................................... 10
Introduction
Hacken OÜ (Consultant) was contracted by YFD (Customer) to conduct a Smart
Contract Code Review and Security Analysis. This report presents the findings of
the security assessment of the Customer's smart contract and its code review
conducted between December 20th, 2020 – December 21st, 2020.
Scope
The scope of the project is smart contract in the mainnet:
Address: 0X4F4F0EF7978737CE928BFF395529161B44E27AD9
We have scanned this smart contract for commonly known and more specific
vulnerabilities. Here are some of the commonly known vulnerabilities that are
considered:
Category Check Item
Code review ▪ Reentrancy
▪ Ownership Takeover
▪ Timestamp Dependence
▪ Gas Limit and Loops
▪ DoS with (Unexpected) Throw
▪ DoS with Block Gas Limit
▪ Transaction-Ordering Dependence
▪ Style guide violation
▪ Costly Loop
▪ ERC20 API violation
▪ Unchecked external call
▪ Unchecked math
▪ Unsafe type inference
▪ Implicit visibility level
▪ Deployment Consistency
▪ Repository Consistency
▪ Data Consistency
Functional review ▪ Business Logics Review
▪ Functionality Checks
▪ Access Control & Authorization
▪ Escrow manipulation
▪ Token Supply manipulation
▪ Assets integrity
▪ User Balances manipulation
▪ Data Consistency manipulation
▪ Kill-Switch Mechanism
▪ Operation Trails & Event Generation
Executive Summary
According to the assessment, the Customer's smart contract has not critical
vulnerabilities and can be considered secure.
1
Insecure Poor secured Secured Well-secured
You are
Our team performed an analysis of code functionality, manual audit, and
here1
automated checks with Mythril and Slither. All issues found during automated
analysis were manually reviewed, and important vulnerabilities are presented in
the Audit overview section. A general overview is presented in AS-IS section, and
all found issues can be found in the Audit overview section.
Security engineers did not find severity issues during the audit.
1 Look for details and justification in conclusion section
Severity Definitions
Risk Level Description
Critical vulnerabilities are usually straightforward to exploit and can
Critical
lead to assets loss or data manipulations.
High-level vulnerabilities are difficult to exploit; however, they also
High have a significant impact on smart contract execution, e.g., public
access to crucial functions
Medium-level vulnerabilities are essential to fix; however, they can't
Medium
lead to assets loss or data manipulations.
Low-level vulnerabilities are mostly related to outdated, unused,
Low etc. code snippets that can't have a significant impact on
execution
Lowest / Code Lowest-level vulnerabilities, code style violations, and info
Style / Best statements can't affect smart contract execution and can be
Practice ignored.
AS-IS overview
Description
YfDFI_finance is an ERC20 token contract based on the OpenZeppelin source
code. The only difference is the constructor function, which mints 20,000 YFD
tokens. After the contract is deployed, new tokens cannot be minted.
Imports
YfDFI_finance contract has 10 imports:
• Context — from OpenZeppelin
• IERC20 — from OpenZeppelin
• SafeMath — from OpenZeppelin
Inheritance
YfDFI_finance contract inherits Context and IERC20.
Usings
YfDFI_finance contract use:
• SafeMath for uint256;
Fields and Functions
The functions and fields of the YfDFI_finance contract are identical to the
ERC20 contract from OpenZeppelin. The only function that is different is
the constructor. In the constructor, 20,000 YFD tokens are minted.
Audit overview
Critical
No critical issues were found.
High
No high issues were found.
Medium
No medium issues were found.
Low
No low issues were found.
Lowest / Code style / Best Practice
No lowest severity issues were found.
Conclusion
Smart contracts within the scope were manually reviewed and analyzed with
static analysis tools. For the contract, high-level description of functionality was
presented in As-is overview section of the report.
Security engineers did not find severe issues during the audit.
Disclaimers
Hacken Disclaimer
The smart contracts given for audit have been analyzed in accordance with the
best industry practices at the date of this report, in relation to cybersecurity
vulnerabilities and issues in smart contract source code, the details of which are
disclosed in this report (Source Code); the Source Code compilation,
deployment, and functionality (performing the intended functions).
The audit makes no statements or warranties on the security of the code. It also
cannot be considered as a sufficient assessment regarding the utility and safety
of the code, bugfree status, or any other statements of the contract. While we
have done our best in conducting the analysis and producing this report, it is
important to note that you should not rely on this report only - we recommend
proceeding with several independent audits and a public bug bounty program
to ensure the security of smart contracts.
Technical Disclaimer
Smart contracts are deployed and executed on blockchain platform. The
platform, its programming language, and other software related to the smart
contract can have its own vulnerabilities that can lead to hacks. Thus, the audit
can't guarantee explicit security of the audited smart contracts.