preSaleMasterForToken.sol
Issue 01
Description
There is no guarantee that the owner deposits will satisfy the presale and liquidity rates.
Issue 02
Description
The functions call external contracts, exposing themselves to potential reentrancy attacks.
The code does not follow check effect interactions pattern.
Recommendation
Add a reentrancy guard and follow check-effect interactions pattern.
Issue 03
Description
Use a modifier instead of the presale require statement for better readability.
Issue 04
Description
The investor array's size is limitless. Iterating over an unbounded array may cause the transaction to hit the block gas limit.
Recommendation
Use a mapping to track contributions.
Issue 05
Description
The function does not change the user's deposit value, hence any user can withdraw their deposit multiple times and drain the contract.
Recommendation
Add a require statements that makes sure the user can withdraw their deposit and set deposits[msg.sender] to 0 after the withdrawal.
Issue 06
Description
The function does not remove the user from the investors array.
Issue 07
Description
The owner can lock funds in the contracts by never calling this function if the presale exceeds softcap
Issue 08
Description
listingRate does not subtract the fees taken from the amount listed. Consequently, users may be unable to withdraw their tokens from the contract as the amount of tokens listed does not match the actual amount of tokens in the contract.
Issue 09
Description
The contract multiplies listingRate by the amount of amount to get the number of tokens. Therefore, listingRate should be calculated as token/ETH (token per ETH). However it is currently calculated as ETH/token (ETH per token)
Issue 10
Description
If a liquidity pool already exists, there may unrecoverable leftover tokens in the contract.
Issue 11
Description
Move the following line into the if block to avoid storing the value in storage.
Issue 12
Description
The removal can be done in constant time by passing the indexes if the accounts to remove.
Issue 13
Description
listingRate is multiplied by a factor.
Issue 14
Description
The function may be called anytime. Should the function be called before presaleEndTimestamp, (now - presaleEndTimeStamp) will underflow.
Issue 15
Description
deposits[msg.sender] is zeroed and then sent out as the value, so users will always withdraw 0 tokens - the value must be kept aside before zeroing it out.
Last updated