Airswap Security Smart Contract Audit

Summary

The AirSwap smart contracts are well-documented and generally follow best practices. However, several issues were discovered during the audit that may cause the contracts to not behave as intended, such as funds being to be locked in contracts, or incorrect checks on external contract calls. These findings, along with several other issues noted below, should be addressed before the contracts are ready for production. **Update:** Fluidity has addressed our concerns as of commit [857e296](https://github.com/airswap/airswap-protocols/commit/857e296ad74075d19797550e2879ae3a95a71240). *Disclaimer:* as the contracts in `source/tokens/contracts/` are claimed to be direct copies from OpenZeppelin or deployed contracts taken from Etherscan, with minor event/variable name changes. These files were not included as part of the final audit.

Project

AirSwap

Ethereum

No active critical issues

Last audited on 2020/02/04

Auditor

287 audits on Trustblock

Multi-Tags

Issues (9)

	Low	Medium	High	Critical	Total
Not fixed	6	2	1	-	9
Fixed	-	-	-	-	0
Total	6	2	1	0	9

Contracts (39)

#	File Name
11	source/delegate-factory/contracts/Migrations.sol
12	source/index/contracts/Imports.sol
13	source/tokens/contracts/interfaces/IWETH.sol
14	source/types/test/MockTypes.sol
15	source/delegate-factory/contracts/DelegateFactory.sol
16	source/index/contracts/Index.sol
17	source/tokens/contracts/KittyCore.sol
18	source/delegate/contracts/Delegate.sol
19	source/delegate/contracts/Imports.sol
20	source/indexer/contracts/interfaces/IIndexer.sol

Airswap

Summary

Issues (9)

Funds may be locked if `setRuleAndIntent` is called multiple timesnot_fixed/high

Centralization of Powernot_fixed/medium

Integer arithmetic may cause incorrect pricing logicnot_fixed/medium

`isValid()` does not check that the `validator` contract is correct not_fixed/low

`transferFrom()` success should not be checked by querying token balancesnot_fixed/low

Contracts (39)