Shiba Memu - Audit

CertiK5 Jul 2023Files named in the report

CertiK reviewed Shiba Memu (Shiba Memu - Audit) on 5 Jul 2023: 7 findings, 0 critical; 3 marked fixed, 2 acknowledged, 2 open.

No open critical findings

Open the report Open Shiba Memu’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	2	0	0
Medium	0	0	2
Low	0	2	1

MediumIncorrect Transfer AmountFixed

The `amount` is not multiplied with the decimal point adjustment factor `10 ** saleToken.decimals()`. ```solidity saleToken.safeTransfer(msg.sender, amount); ``` The `amount` is the number of whole tokens, but `saleToken.safeTransfer` is expecting a fractional amount. Thus, the owner will claim only a fraction of unsold tokens at a time. Even though the function could be executed unlimited times, it will be extremely gas consuming to retrieve all unsold tokens. The transfer amount should be `amount * 10 ** saleToken.decimals()`.

MediumPotential to claim tokens bought by userFixed

`claimUnsold` is used for owners to claim unsold tokens. There is no check to grantee that users has claimed their tokens before the owner calls `claimUnsold`. Although the amount is restricted to unsold amount, the owner can call this function unlimited times, allowing him to claim user purchased tokens.

LowLack of Time BoundaryFixed

The `_saleStartTime`, `_saleEndTime`, and `_claimStartTime` could be set to a past date or many years in the future, without any defined upper limit. A small mistake may make it impossible to claim tokens until hundreds of years later.