The Rouge Project Smart Contract Audit
By: New Alchemy
Tags: Solidity, Smart Contracts, Security, Token Sale, Ethereum

The audit identified a variety of issues with impacts ranging from very minor to moderate. The most significant finding addresses concerns that the contract owner can arbitrarily change the pool of reserve tokens for the year+2 sale by repeatedly calling a specific function.

A majority of the code was standard and copied from widely-used and reviewed contracts and, as a result, many of the findings pertained to the custom portions of code related to the contract defining the behavior of the crowdsale itself.

Re-test notes: the moderate issue uncovered by the initial review of the contracts was completely fixed by the Rouge Project only leaving very minor findings.

General Discussion

The RGEToken and RougeTGE contracts implement a standard EIP20 token with symbol RGE and a crowdsale (here named TGE as Token Generation Event). The RGE token is a utility token giving the possibility to use the Rouge Network protocol as described in the white paper. The RGE token relies on code copied from https://github.com/ConsenSys/Tokens to implement the EIP20 token from which it inherits.

The code specifies Solidity version 0.4.18, which is older than the the recommended latest version at the time of the audit, which is 0.4.23. The Rouge Project should use the latest version of Solidity in order to take advantage of the latest features and improvements that Solidity has to offer.

New Alchemy discovered that the contracts implemented do not use SafeMath (from the OpenZeppelin project). SafeMath defines functions for mathematical operations that will throw errors in the cases of integer overflow or underflows, and most of the code may be able to benefit from using the library. Consistently using the SafeMath operations would guarantee protections from integer overflow and underflow conditions that could result in unsafe behavior, without having to consider for each case whether those conditions are possible.

Re-test notes: The Solidity version specified in the audited contracts was updated to version 0.4.23 which is the current latest version as of updating this document. Additionaly, New Alchemy noted that The Rouge Project took this opportunity to also update the EIP20 code from https://github.com/ConsenSys/Tokens to its latest version. This version EIP20 provides minor tweaks to make the code compliant with the language updates from Solidity v0.4.21 (events broadcasted through the emit keyword).

Contract / Whitepaper / Website Token Coherence

This section describes how accurately the values from the whitepaper are implemented in the actual contracts. Contracts should aim to implement as closely as possible the various descriptions found in the whitepaper and website. For this section, the white paper is going to be considered as the reference for all values. The amount of discrepancies found between white paper and actual contracts should help users decide the level of trust they can put into the contracts as they are implemented.

*: The white paper and website indicate that the price per RGE token of $0.076 USD will be used to determine the price in ETH at TGE (Token Generation Event). The TGE contract effectively implements a one time set fixed price for RGE tokens determined at contract creation on the blockchain (as the accurate price of a token in ETH can’t be predicted before the TGE and all transactions are made in ETH). In this respect the contract effectively implements the behavior described in the white paper as long as the contract owner uses an accurate exchange rate (ETH/USD) taken as close as possible to the TGE to initiate the RougeTGE contract. Potential buyers should check on the blockchain the public tokenPrice value from the RougeTGE contract before making any transfers to the contract to ensure the price was accurately set. That price can not be changed by anyone (including contract owner) once the contract has been created.