Penetration Test Report (BlazeInformationSecurity): Annihilatio smart contract security review 1.0 final

Smart Contract Security Review
Annihilat.io ANNI Salary Tokens
CLIENT
Annihilat.io
BRAZIL+55 81 3071.7148
R. VISCONDE DE JEQUITINHONHA 279 / EMPRESARIAL TANCREDO NEVES / ROOM 701 / RECIFE-PE
PORTUGAL+351 22 120 1335
PRAÇA MOUZINHO DE ALBUQUERQUE 113 / 5TH FLOOR / PORTO
SMART CONTRACT SECURITY REVIEW
SUMMARY
1.0 DOCUMENT CONTROL............................................................................................................................3
1.1 DOCUMENT CONTROL..................................................................................................................................3
1.2 DOCUMENT DISTRIBUTION.........................................................................................................................3
2.0 INTRODUCTION........................................................................................................................................3
3.0 EXECUTIVE SUMMARY...........................................................................................................................4
4.0 SCOPE.......................................................................................................................................................5
5.0 METHODOLOGY - SMART CONTRACT SECURITY REVIEW................................................................5
6.0 TECHNICAL SUMMARY...........................................................................................................................6
6.1 DESCRIPTION OF THE SMART CONTRACTS...........................................................................................6
6.1.1 MULTISIG WALLET..................................................................................................................................6
6.1.2 TOKEN........................................................................................................................................................6
6.2 OBSERVATIONS ABOUT MULTISIG_FLAT.SOL........................................................................................6
7 VULNERABILITIES .....................................................................................................................................7
7.1 IMPOSSIBILITY TO TRADE ANNI TOKENS BACK INTO ETH WILL HOLD INVESTOR'S FUNDS .7
7.2 DEVIATION FROM TECHNICAL SPECIFICATIONS OF THE CONTRACT AND CODE FOR
LIQUIDATING TOKENS .........................................................................................................................................9
7.3 ABSENCE OF EXPLICIT VISIBILITY IN SOME FUNCTION DECLARATIONS ...................................11
8.0 ADDITIONAL REMARKS........................................................................................................................12
9.0 CONCLUSION..........................................................................................................................................12
10.0 APPENDIX A - VULNERABILITY CRITERIA CLASSIFICATION.......................................................13
11.0 APPENDIX B - AUTOMATED ANALYSIS RESULTS..........................................................................13
11.1 SOL-FUNCTION-PROFILER.....................................................................................................................13
11.2 SOLGRAPH...................................................................................................................................................14
11.3 OYENTE.........................................................................................................................................................14
11.4 MYTH.............................................................................................................................................................17
@2017 Blaze Information Security
SMART CONTRACT SECURITY REVIEW
1.0 DOCUMENT CONTROL
1.1 DOCUMENT CONTROL
Delivery
Authors Date Pages Version Status
Victor Farias and Julio 20/12/2017 16 0.9 Preliminary
Fort report
Victor Farias and Julio 22/12/2017 17 1.0 Final report
Fort
1.2 DOCUMENT DISTRIBUTION
Name Title Organisation
Julio Fort Director of Professional Services Blaze Information Security
Vlad Smirnov Founder Annihilat.io
2.0 INTRODUCTION
ThisdocumentpresentstheresultsofaSmartContractSecurityReviewforAnnihilat.io.
Thisengagementaimedtoverifywhetherthesmartcontractonlydoeswhatitisintended
todo,andtodiscoversecurityvulnerabilitiesthatcouldnegativelyaffecttheAnnihilat.io’s
ANNItoken before the contract gets deployed into the blockchain network.
Annihilat.io is an idea of funding based on the concept of Initial Development Offering
(IDO). Essentially, it works as a salary token for contributors of a project that raised
capital in an IDO. Annihilat.io uses an Ethereum ERC20-based token and contracts were
written in Solidity. Details about Annihilat.io and IDO can be found in the whitepaper:
https://github.com/annihilatio/ido/blob/master/article.pdf
The analysis focused on vulnerabilities related to implementation and on issues caused
byarchitectureanddesignerrors,aswellasinconsistenciesbetweenthedocumentation
and the code.
Foreachcodepatternnon-compliantwiththeEthereumtokenstandardortothecontract
specification, deviation of best practices and vulnerability discovered during the
assessment, Blaze Information Security attributed a risk severity rating and, whenever
possible, validated the existence of the vulnerability with a working exploit code.
The main objectives of the assessment were the following:
• Identify the main security-related issues present in the smart contract
• Assess the level of secure coding practices present in the project
• Obtain evidences for each vulnerability and, if possible, develop a working exploit
@2017 Blaze Information Security 3
SMART CONTRACT SECURITY REVIEW
• Document, in a clear and easy to reproduce manner, all procedures used to
replicate the issue
• Recommend mitigation factors and fixes for each defect identified in the analysis
• Provide context with a real risk scenario based on a realistic threat model
3.0 EXECUTIVE SUMMARY
The engagement was performed in a period of five business days, including report
writing.Thesmartcontractsecurityreviewcommencedon12/12/2017andendedon18/
12/2017, finishing with the preliminary version of this report.
On 21/12/2017 all findings reported by Blaze Information Security were fixed
accordingly by Annihilat.io. The issues are no longer present in the code of the
contracts and were fixed in commits b287f07393f8b5b67cbde5c1d70dfc31b9cd5aa1
andafdf264d030e8313fd65e1c8c236d2a958eff7c7.
Theauditwasdonewiththeassistanceofautomatedtoolsaswellassubjectedtomanual
review. The generatedEVMcode was not inspected in this assessment.
Therewerethreeissuesdiscoveredinthecontractsauditedinthisengagement.Overall,
the contracts under scope contained significant vulnerabilities that could lead to loss
of tokens and cause a significant impact to the operations of Annihilat.io. They also
lacked defensive security coding patterns and had other non-recommended Solidity
programming practices.
Thefollowingtablesummarizestheissuesfoundinthesmartcontractsunderscopefor
this audit.
Itisimportanttonoticethesevulnerabilitiesarenolongerpresent,astheyhavebeen
corrected by Annihilat.io and the fixes reviewed by the auditors.
POINT TITLE SEVERITY
1 Impossibility to trade ANNI tokens back into ETH will hold CRITICAL
investor’s funds
2 Deviationfromtechnicalspecificationsofthecontractandcode MEDIUM
for liquidating tokens
3 Absence of explicit visibility in some function declarations LOW
@2017 Blaze Information Security 4
SMART CONTRACT SECURITY REVIEW
4.0 SCOPE
The scope of this security review is comprised of two smart contracts written in Solidity.
• Project name:annihilatio
• Commit:8ad0a1bdc7dff7e40ad5cf61aea89deaa982eab5
Filename Lines of code
Token_flat.sol 345
Multisig_flat.sol 498
Thecodeauditedisopensourceandcanbefoundathttps://github.com/annihilatio/ido/
tree/8ad0a1bdc7dff