Penetration Test Report (BlazeInformationSecurity): Public Jury.Online Smart Contract Security Review

de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY
REVIEW
JURY.ONLINE SMART CONTRACT
CLIENT DATE
JURY.ONLINE 03/29/2018
WWW.BLAZEINFOSEC.COM
de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY REVIEW
SUMMARY
1.0 DOCUMENT CONTROL....................................................................................................................3
1.1 DOCUMENT CONTROL..................................................................................................................................3
1.2 DOCUMENT DISTRIBUTION.........................................................................................................................3
2.0 INTRODUCTION..............................................................................................................................4
3.0 EXECUTIVE SUMMARY...................................................................................................................5
4.0 SCOPE.............................................................................................................................................6
5.0 METHODOLOGY - SMART CONTRACT SECURITY REVIEW...........................................................6
6.0 TECHNICAL SUMMARY..................................................................................................................7
6.1 DESCRIPTION OF THE SMART CONTRACTS..........................................................................................7
7.0 VULNERABILITIES.........................................................................................................................8
7.1 ABSENCE OF ARITHMETIC UNDERFLOW AND OVERFLOW CHECKS IN PARTS OF THE
CONTRACT .............................................................................................................................................................8
8.0 CONCLUSION................................................................................................................................10
9.0 APPENDIX A - VULNERABILITY CRITERIA CLASSIFICATION....................................................11
10.0 APPENDIX B - OUTPUT OF AUTOMATED SCANNERS..............................................................12
10.1 SOL-FUNCTION-PROFILER.....................................................................................................................12
10.2 OYENTE........................................................................................................................................................13
@2018 BLAZE INFORMATION SECURITY
de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY REVIEW
1.0 DOCUMENT CONTROL
11..11 DDOOCCUUMMEENNTT CCOONNTTRROOLL
Authors Delivery Date Pages Version Status
Victor Farias and Julio Fort 16/03/2018 10 0.9 Draft for Q&A
Victor Farias and Julio Fort 18/03/2018 22 1.0 Final report
Victor Farias and Julio Fort 29/03/2018 22 1.1 Final report – fixes added
11..22 DDOOCCUUMMEENNTT DDIISSTTRRIIBBUUTTIIOONN
Name Title Organisation
Julio Fort Director of Professional Services Blaze Information Security
Alexander Shevtsov Founder Jury.Online
@2018 BLAZE INFORMATION SECURITY
3
de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY REVIEW
2.0 INTRODUCTION
DISCLAIMER: This document presents the findings of a security review of the smart
contracts under scope of the audit. As a time-boxed and best effort exercise, it does not
guaranteetherearenoothersecurityissuesinthesmartcontract.Theresultsofthisaudit
should not be read as an investment advice.
Jury.Onlineaimstocreateaplatformtofacilitatedealsbetweendifferentparties.Theplatform
putsitselfinthemiddleofadealandworksasaescrowservice;itmediatesagiventransaction
and if all parties are satisfied with the outcome of the deal, the transaction is completed
successfully. As a escrow service, it also mediates disputes between the parties of a deal.
Jury.Online provides interaction between judges, arbitrators and parties of a deal for dispute
resolutions.
Codepatternsnon-compliantwiththeEthereumtokenstandardortothecontractspecification,
deviation of best practices and vulnerability discovered during the assessment, Blaze
Information Security attributed a risk severity rating and, whenever possible, validated the
existence of the vulnerability with a working exploit code.
Foreachvulnerabilitydiscoveredduringtheassessment,BlazeInformationSecurityattributed
ariskseverityratingand,wheneverpossible,validatedtheexistenceofthevulnerabilitywitha
working exploit code.
The main objectives of the assessment were the following:
Identify the main security-related issues present in the smart contract
Assess the level of secure coding practices present in the project
Obtain evidences for each vulnerability and, if possible, develop a working exploit
Document, in a clear and easy to reproduce manner, all procedures used to replicate the
issue
Recommend mitigation factors and fixes for each defect identified in the analysis
Provide context with a real risk scenario based on a realistic threat model
@2018 BLAZE INFORMATION SECURITY
4
de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY REVIEW
3.0 EXECUTIVE SUMMARY
The engagement was performed in a total period of 6 business days, including report writing.
Thesmartcontractsecurityreviewcommencedpart-timeon05/03/2018andendedon16/03/
2018, finishing with the preliminary version of this report.
On 23/03/2018 all findings reported by Blaze Information Security were fixed accordingly
byJury.Online.Theissuesarenolongerpresentinthecodeofthecontractsandwerefixed
in the commit3f5f707cfeec36e174702b46be0c8f6850e6a12b.
The audit was done with the assistance of automated tools as well as subjected to manual
review. The generatedEVMcode was not inspected in this assessment.
There was only one minor issue discovered in the contracts audited in this engagement. This
issue was believed to not bring an immediate risk to the contracts, but should be taken as an
advice to improve its security and make it future-proof. The review of the the contracts under
scopedidnotrevealvulnerabilitiesthatcouldleadtolossoftokens,biasofjurors,norproblems
that had the potential to cause a significant impact to the intended operations of Jury.Online.
Jury.Online had defensive security coding patterns and followed many recommended Solidity
programming good practices. Overall the code quality was considered very good, as it was
clear, well commented and easy to understand.
The following table sumarizes the issues found in the smart contracts under scope for this
audit.
POINT TITLE SEVERITY
1 Absence of arithmetic underflow and overflow checks in parts of the contract LOW
@2018 BLAZE INFORMATION SECURITY
5
de2619a265ace9f6f865e94ca0813f59
SMART CONTRACT SECURITY REVIEW
4.0 SCOPE
The scope of this security review is comprised of smart contracts written in Solidity.
Project name:juryonline
Commit:986aca6ca9c666a34632e4e0ed10d2c78d1fa245
Filename Lines of code
ERC20Token.sol 237
JuryOnlineExchanger.sol 28
JuryOnlineICOContract.sol 204
JuryOnlineInvestContract.sol 226
Migrations.sol 23
Pullable.sol 38
The code audited is open source and can be found at https://github.com/juryonline/contracts/
tree/playground(Playground branch)
5.0 METHODOLOGY - SMART CONTRACT SECURITY
REVIEW
Our security-oriented smart contract review follows an organized methodology with the intent
to identify the largest number of vulnerabilities in the contracts under scope from the
perspective of a motivated, technically capable and persistent adversary.
Special attention is directed towards critical areas of the smart contract such as burning
of tokens and functioning of the multi-signature. Our process also looks into other common
implementation issues that lead to problems like reentrancy, mathematical overflows and
underflows, gas-related denial of service, etc.
Blaze’s smart contract review methodology involves automated and manual audit techniques.
The applications are subjected to a round of dynamic analysis using tools like linters,