UVToken security record

The UvToken Android application logs highly sensitive wallet information such as private and public keys as well as different endpoints. By connecting an Android device to a PC, log output from the wallet application applications can be obtained with "adb logcat". It is important that applications do not send sensitive information to log output. The following screenshot shows a private key logged in the Android logcat: 

In the current implementation, function `InsertUVTPledge` will trigger an external call to a user provided address `_pledgeAddr`. ```solidity=422 function InsertUVTPledge( address _userAddr , uint256 _pledgeAmount, address _pledgeAddr ) external { IPledge IPledge_ = IPledge(_pledgeAddr); bool _isValid; (,,,_isValid) = IPledge_.getPledgeInfo(); require(_isValid,"noValid"); payToken(tokenAddress_, _userAddr, _pledgeAmount); IPledge_.insertUVTPledge(_userAddr, _pledgeAmount); } ``` Calling a user provided address is dangerous, especially in a public function with no access control restriction. An attacker could deploy a malicious contract and use the vulnerable function to trigger a call to the malicious contract. In this case, the attacker can bypass the `_isValid` check in L426 and he can transfer tokens hold by any user to the `IFinance_` account, if the user has approved the `UVTPledge` contract.

The implementation of the `isNotContract` check can not cover all scenarios. The check can be bypassed if the call is from the constructor of a smart contract or when the contract is destroyed. In that case, the codesize will also be zero. The "isContract" function in the OpenZeppelin "Address" library uses the similar implementation, but comments mention that "it's unsafe to rely on the check and it can be bypassed". Reference: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol Bypassing the `isNotContract()` check would introduce potential risks to the project.

The "mint" function lacks access control, allowing any user to call it and transfer uvcToken to miner on a daily basis. The reason for allowing everyone to call the "mint" function is unclear to the auditor and we suggest this function should only be accessible from the contract owner. ```solidity=474 function mint() external CanMint isNotContract(msg.sender) returns(bool) { uint256 nDays = (block.timestamp - lastMint_)/CYCLE_; lastMint_ = lastMint_ + nDays * CYCLE_; uvcToken_.safeTransfer(miner_, nDays * numMint_); return true; } ```

The mnemonic phrase is a list of words that can be used to recover a wallet account. Obtaining the mnemonic can potentially allow the attacker to gain full control of the wallet. The application neither has a mechanism in place to stop a user from taking the screenshot of the displayed wallet secrets nor display a warning to remind the user of the risk of taking a screenshot. 

The currently implemented password policy is permissive regarding the requirements related to the password, as it let the user set a weak password such as `Test1234`.

Multiple Solidity versions are used in the codebase. Versions used: `^0.8.4`, `^0.8.7` `^0.8.4` is used in UVToken/uvcMine.sol file. ```solidity=305 pragma solidity ^0.8.4; ``` `^0.8.7` is used in UVToken/uvcMine.sol file. ```solidity=404 pragma solidity ^0.8.7; ```

The application does not implement certificate pinning. Certificate pinning is the act of associating a host with its expected certificate within the application. When the application connects to the host, the stored certificate is compared to the certificate held by the remote host. If the two certificates do not match, the request is dropped. Currently, the application only verifies that the server presents a TLS certificate that is trusted by the Android or iOS trust stores, not validating that the TLS certificate is in fact the one known to be deployed on the servers.

Connections to internal hosts or testing domains such as the ones shown below were observed during the testing: ```http POST /wallet/subscription/coin HTTP/1.1 Host: 192.168.0.110:8008 Content-Type: application/json Connection: close Accept: */* User-Agent: Blockchain Wallet/1.4.1 (iPhone; iOS 14.5.1; Scale/2.00) Accept-Language: en-ES;q=1, es-ES;q=0.9 Content-Length: 1034 Accept-Encoding: gzip, deflate ``` ```http GET /v1/accounts/bi/detail/find HTTP/1.1 Host: wallet-test.uvtoken.org User-Agent: Blockchain Wallet/1.4.1 (iPhone; iOS 14.5.1; Scale/2.00) Accept: */* Accept-Language: en-ES;q=1, es-ES;q=0.9 Accept-Encoding: gzip, deflate Connection: close ``` It is believed that they were part of the testing and/or debugging process.

During the test, it was found that the HTTP response from the server contains the CORS header `Access- Control-Allow-Origin: *`.