V2 - P3C.io Auto-Reinvestment Farm

[p3c-bot]

Audit request

After receiving the results of the previous audit I have gone back and made improvements to the architecture based on the recommendation of the auditor.

The goal is still the same, to provide an interface for users to deposit their P3C and outsiders to reinvest on their behalf.

The issue was that the Farm would allow anybody to link crops. This could be attacked. In this new version, I have changed the architecture of the Farm so that it actually deploys the crop contract itself. The crop contract is the same.

Changes:

• Consolidated Farm and Crop into same file.
• Now Crops are created by the Farm and linked on creation.
• Users can create a crop and send value along with the function call to automatically seed the crop.

Source code

https://github.com/p3c-bot/p3c-bot.github.io/blob/upgrade/contracts/v1.0.0/Farm.sol

Disclosure policy

masterhax@protonmail.com
Please notify publicly.

Platform

ETC

[MrCrambo]

Auditing time 1 day

[yuriy77k]

@MrCrambo assigned.

[danbogd]

Auditing time: 2 days.

[yuriy77k]

@danbogd assigned.

[danbogd]

My report is finished.

[p3c-bot]

A release candidate of The system is live and can be tested here: https://p3c.io/p3c-rc/interact.html

[gorbunovperm]

Estimated auditing time is 1 day.

[yuriy77k]

@gorbunovperm assigned.

[gorbunovperm]

My report is finished.

[yuriy77k]

1. Summary

P3C.io v.2. security audit report performed by Callisto Security Audit Department

2. In scope

1. Farm.sol

3. Findings

In total, 2 issues were reported including:

• 2 low severity issues.

No critical security issues were found.

3.1. No checking for zero address.

Severity: low

Description

Transfer function and constructor Crop members of Crop contract do not require the to address to be non null before transfer.

3.2. Known vulnerabilities of ERC-20 token

Severity: low

Description

ERC20 Tokens have some well-known issues (listed below), This is just a reminder for the contract developers.

1. Lack of transaction handling mechanism issue.

The above mentioned issues are well documented, a basic search can help to get more information.

4. Conclusion

The vulnerability from the previous contract has been fixed. No new ones were found. The smart contract safe to deploy.

5. Revealing audit reports

https://gist.github.com/yuriy77k/527953e18d71fe7a3dcb35c6fc14462f

https://gist.github.com/yuriy77k/f1e42e367828766c99d2572754f7dedb

https://gist.github.com/yuriy77k/24f888209386b7d38f6258fcf334bec9