Fastex - Token Distribution SC

CertiK14 Oct 2022Files named in the report

CertiK reviewed Fastex (Fastex - Token Distribution SC) on 14 Oct 2022: 5 findings, 0 critical; 3 marked fixed, 1 acknowledged, 1 open.

No open critical findings

Open the report Open Fastex’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	1	0
Medium	0	0	2
Low	1	0	1

MediumIncorrect Change Owner ChecksFixed

Before transferring the owner from `address1` to `address2`, ensure that `address1` is the owner and `address2` is not. The checks in the following code are opposite. ```solidity=125 if (TransactionType.ChangeOwner == transaction.transactionType) { require(! isOwner[transaction.address1], 'address1 must be owner'); require(isOwner[transaction.address2], 'address2 cannot be owner'); uint256 index = _ownerIndex(transaction.address1); owners[index] = transaction.address2; isOwner[transaction.address1] = false; isOwner[transaction.address2] = true } ```

MediumLack of Minimum Requirement on the `numberOfRequiFixed

Currently, the requirement on the `numberOfRequiredConfirmations` is that it should be greater than 0 and no greater than `_owners.length`. Hypothetically, the `_owners.length` could be 5 or 7 and the `numberOfRequiredConfirmations` could be 1, in which case the contract does not really serve the purpose of a multisig contract.

LowUsage of `transfer`/`send` for sending EtherFixed

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=178 recipientAddress_.transfer(address(this).balance); ``` - `FasttokenDistribution.refund` uses `transfer()`.