Ai Earn security record

The `approve` function will suffer race conditions whereby an adjustment of an existing approval. It can be exploited to utilize the full amount of the previously set approval, as well as the newly set approval by monitoring the transaction mempool. Exploit scenario: 1. Alice calls `approve(Bob, 100)` to allow Bob to spend 100 tokens. 2. Alice changes her mind and calls `approve(Bob, 50)`. 3. Bob observes the second `approve(Bob, 50)` function call and calls `transferFrom(Alice, Bob, 100)` before the second `approve(Bob, 50)` call. 4. The above scenario can be achieved by front-running. In this case, Bob can transfer another 50 tokens from Alice and in total, he transferred 150 tokens from Alice.

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity=22 function transfer(address to, uint256 value) public returns (bool) { ``` --- ```solidity=30 function transferFrom(address from, address to, uint value) public returns(bool) { ``` --- ```solidity=39 function approve(address spender, uint256 value) public returns (bool) { ```

The function `balanceOf(address owner)` can be restricted to `view`, since no storage change in the function implementation.

The `transferFrom` function is expected to not allow transfer from address(0), and currently the validation is missing.

State variables that never change should be declared as `constant` to save gas. ```solidity=6 uint public totalSupply = 1000000000000 * 10 ** 18; ``` - `totalSupply` should be declared `constant`. --- ```solidity=7 string public name = "A.I.Earn"; ``` - `name` should be declared `constant`. --- ```solidity=8 string public symbol = "AIE"; ``` - `symbol` should be declared `constant`. --- ```solidity=9 uint public decimals = 18; ``` - `decimals` should be declared `constant`.

The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.