{Odin}
Verify a smart contract, learn how to fix in real-time.
How to use {Odin}?
Step.1
Upload File & Submit.
You can start analysis at any time by upload and submit
the single .sol file.
the single .sol file.
Single .sol file
Step.2
Review the analysis results.
Check the issues of your code. Our state-of-the-arts analyzers
perform a security assessment in real-time. A thousand lines
of code analysis takes less than a second.
perform a security assessment in real-time. A thousand lines
of code analysis takes less than a second.
[All Pass]
[Fail]
Guide on how to fix the issues.
You can get the action plan in detail to fix the issues.
1. Omission of the transfer in disburseJob leads to inconsistent balance state / lines: 13 - 18
High
SOOHO
13 | function disburseJob(string _jobId, address[] _recipients, uint256[] _amounts) public canDisburse { | |
14 | require(jobBalances[_jobId] > 0); | |
13 | function disburseJob(string _jobId, address[] _recipients, uint256[] _amounts) external canDisburse { | |
14 | require(jobBalances[_jobId] > 0, "_jobId has no available balance"); | |
15 | for(uint i = 0; i < _recipients.length; i++) { | |
15 | for(uint256 i = 0; i < _recipients.length; i++) { | |
16 | 16 | jobBalances[_jobId] = jobBalances[_jobId].sub(_amounts[i]); |
17 | StandardToken(renderTokenAddress).increaseApproval(_recipients[i], _amounts[i]); | |
17 | StandardToken(renderTokenAddress).transfer(_recipients[i], _amounts[i]); | |
18 | 18 | } |
In detail
The disburseJob function later takes care of redistributing funds among the recipients.
This function simply sets an allowance, which the recipients can then use to transfer the tokens themselves.
Even if the jobBalances mapping cannot be traversed to get the total balance without an external listing of jobs, consider implementing the Escrowbalance tracking in a way that doesn't lead to inconsistencies, or using the PullPayment/Escrow solution provided in the OpenZeppelin suite.
This function simply sets an allowance, which the recipients can then use to transfer the tokens themselves.
Even if the jobBalances mapping cannot be traversed to get the total balance without an external listing of jobs, consider implementing the Escrowbalance tracking in a way that doesn't lead to inconsistencies, or using the PullPayment/Escrow solution provided in the OpenZeppelin suite.
2. MixinSignatureValidator: Insecure signature validator SignatureType.Caller / lines: 42 - 56
Medium
SOOHO
42 | // Implicitly signed by caller. | |
43 | // The signer has initiated the call. In the case of non-contract | |
44 | // accounts it means the transaction itself was signed. | |
45 | // Example: let's say for a particular operation three signatures | |
46 | // A, B and C are required. To submit the transaction, A and B can | |
47 | // give a signature to C, who can then submit the transaction using | |
48 | // `Caller` for his own signature. Or A and C can sign and B can | |
49 | // submit using `Caller`. Having `Caller` allows this flexibility. | |
50 | } else if (signatureType == SignatureType.Caller) { | |
51 | require( | |
52 | signature.length == 0, | |
53 | "LENGTH_0_REQUIRED" | |
54 | ); | |
55 | isValid = signerAddress == msg.sender; | |
56 | return isValid; |
In detail
MixinSignatureValidator has a signature validator called SignatureType.Caller that allows an order to be valid if order.makerAddress == msg.sender. If the SignatureType.Caller is set, no actual signature verification is performed for the order. An attacker could attack contracts that have:
1. ERC20/ERC721 tokens.
2. approved the Exchange proxy contracts to make transfers on their behalf.
3. a function that allows users to make calls to the exchange trading functions.
1. ERC20/ERC721 tokens.
2. approved the Exchange proxy contracts to make transfers on their behalf.
3. a function that allows users to make calls to the exchange trading functions.
3. Missing checks for null addresses in RenderToken and Airdrop contracts / lines: 42 - 46
Low
SOOHO
42 | 42 | function setEscrowContractAddress(address _escrowAddress) public onlyOwner { |
43 | require(_escrowAddress != address(0), "_escrowAddress must not be null"); | |
44 | 44 | escrowContractAddress = _escrowAddress; |
45 | 45 | emit EscrowContractAddressUpdate(escrowContractAddress); |
46 | 46 | } |
In detail
In RenderToken, the setEscrowContractAddress function allows the token's owner to change the escrow's address (i.e. the contract variable escrowContractAddress). However, the function does not implement a check to prevent the null address from being set. Consider implementing no-null address validations before setting these variables to avoid potential problems downstream.