Penetration Test Report (SecuRing): Basket Coin Token   2021 04 15

www.securing.biz
S C S R
MART ONTRACTS ECURITY EVIEW OF
B C T
ASKET OIN OKEN
BSKT T L
FOR ECHNOLOGIES IMITED
R
EPORT
document version: 1.0
author: Damian Rusinek
test time period: 2021-04-14 – 2021-04-15
report date: 2021-04-15
Smart Contracts Security Review of BasketCoin Token
TABLE OF CONTENTS
1. Executive summary ..................................................................................................................................... 2
1.1. Testing overview ................................................................................................................................ 2
1.2. Summary of test results .................................................................................................................... 2
1.3. Disclaimer ............................................................................................................................................ 3
2. Summary of identified vulnerabilities ...................................................................................................... 4
2.1. Risk classification ............................................................................................................................... 4
2.2. Identified vulnerabilities ................................................................................................................... 5
3. Project description ...................................................................................................................................... 6
3.1. Basic information ............................................................................................................................... 6
3.2. Target in scope ................................................................................................................................... 6
3.3. Threat analysis .................................................................................................................................... 6
3.4. Scope .................................................................................................................................................... 6
3.5. Exclusion and remarks ...................................................................................................................... 7
4. Vulnerabilities ............................................................................................................................................... 8
4.1. Burning tokens below the specified minimum total supply ..................................................... 8
4.2. One-step ownership transfer .......................................................................................................... 9
4.3. Front-runnable approve function ................................................................................................ 10
5. Recommendations .................................................................................................................................... 12
5.1. Use simple to understand variable names ................................................................................. 12
5.2. Validate the fees ............................................................................................................................. 12
6. Terminology ............................................................................................................................................... 13
7. Contact ....................................................................................................................................................... 14
- 1 -
Smart Contracts Security Review of BasketCoin Token
1. EXECUTIVE SUMMARY
1.1. Testing overview
BasketCoin Token (BSKT) is a token designed in the Ethereum ecosystem (ERC20) and its
basic characteristics can be briefly presented using the following wording:
• deflationary,
• with the system of repurchase and burning of tokens,
• with collateral – covering its value,
• with options for staking,
• with fair, transparent and well-constructed tokenomics,
• with the subsequent implementation of management tokens.
The security review of the BasketCoin Token smart contract was meant to verify whether
the proper security mechanisms were in place to prevent users from abusing the contracts’
business logic and to detect the vulnerabilities which could cause financial losses to the
client or its customers.
Security tests were performed using the following methods:
• Source code review,
• Verification of compliance with Smart Contracts Security Verification Standard
(SCSVS) in a form of code review.
1.2. Summary of test results
• During the penetration testing neither critical vulnerabilities (vulnerabilities which
are easy to exploit and have high risk impact) nor medium risk vulnerabilities were
found.
• There were 3 vulnerabilities with low impact on risk identified. Their exploitation
results are following:
o Burning more tokens than allowed according to the documentation.
o Lost control over the token and potential loss of all Ethers on the contract if
it happens during the sale.
o Transferring victim’s tokens on behalf of the previous allowance as well as
the new allowance.
• Two recommendations have been proposed that do not have any direct risk impact.
However, it is suggested to implement them due to good security practices.
• The scope of the test included the source code of the token contract already
deployed on mainnet. Security review of the development process (including
testing) was out of scope.
- 2 -
Smart Contracts Security Review of BasketCoin Token
1.3. Disclaimer
The security review described in this report is not a security warranty. It does not
guarantee the security or correctness of reviewed smart contracts. Securing smart
contract platforms is a multi-stage process, starting from threat modeling, through
development based on best security practices, security reviews and formal verification,
ending with constant monitoring and incident response. Therefore, we strongly
recommend implementing security mechanisms at all stages of development and
maintenance.
- 3 -
Smart Contracts Security Review of BasketCoin Token
2. SUMMARY OF IDENTIFIED VULNERABILITIES
2.1. Risk classification
Vulnerabilities
Risk impact Description
Vulnerabilities that affect the security of the entire system, all
users or can lead to a significant financial loss (e.g. tokens).
Critical
It is recommended to take immediate mitigating actions or
limit the possibility of vulnerability exploitation.
Vulnerabilities that can lead to escalation of privileges, a
denial of service or significant business logic abuse.
High
It is recommended to take mitigating actions as soon as
possible.
Vulnerabilities that affect the security of more than one user
or the system, but might require specific privileges, or custom
Medium prerequisites.
The mitigating actions should be taken after eliminating the
vulnerabilities with critical and high risk impact.
Vulnerabilities that affect the security of individual users or
require strong custom prerequisites.
Low
The mitigating actions should be taken after eliminating the
vulnerabilities with critical, high, and medium risk impact.
Recommendations
Methods of increasing the security of the system by implementing good security
practices or eliminating weaknesses. No direct risk impact has been identified.
The decision whether to take mitigating actions should be made by the client.
- 4 -
Smart Contracts Security Review of BasketCoin Token
2.2. Identified vulnerabilities
Vulnerability Risk impact
4.1 Burning tokens below the specified minimum total supply Low
4.2 One-step ownership transfer Low
4.3 Front-runnable approve function Low
Recommendations
5.1 Use simple to understand variable names
5.2 Validate the fees
- 5 -
Smart Contracts Security Review of BasketCoin Token
3. PROJECT DESCRIPTION
3.1. Basic information
Damian Rusinek
Testing team
Paweł Kuryłowicz
Testing time period 2021