Worthpad Security Audit Report

Are Your Funds Safe?

Our expert team at Callisto Network has conducted an in-depth security audit of the Worthpad smart contract. This audit aims to ensure the security of your funds by identifying and assessing any potential vulnerabilities. Here, we present our findings:

1
Total Finding(s)
0 - Hight severity issue(s)
0 - Medium severity issue(s)
1 - Low severity issue(s)
2 note(s)
8 owner privilege(s)

Executive Summary

This report presents the results of the security audit conducted by the Callisto Network Security Department on the Worthpad smart contract in December 2021. It analyzes the contract’s security in-depth and highlights any identified vulnerabilities.

1. Scope of the Audit

The audit focused on the following Worthpad contract:

Blockchain: Binance Smart Chain.

Commit 71760542a40e580ad6c0c57c5ec5798072c0a3b0.

  • WorthToken.sol
  • WorthTokenSale.sol
  • WorthTokenTimeLock.sol

1.1 Excluded

OpenZeppelin standard imports were excluded from the audit.

2. Audit Findings

Our audit reported a total of 1 finding(s), categorized as follows:

  • 0 high-severity issue(s).
  • 0 medium severity issue(s).
  • 1 low-severity issue(s).

In addition to these findings, our audit identified 10 additional points, detailed in the following sections:

  • 2 note(s).
  • 8 owner privilege(s).
No critical security issues were found.

2.1 Owner Privileges

null

Description:

WorthToken contract owner has rights to:

  1. Exclude/include any account from/in the fee.
  2. Set Worth DVC Fund fee percentage in the 1% – 10% range.
  3. Set liquidity fee percentage in the 1% – 10% range.
  4. Change the maximal amount per transaction from 0 to 100,000,000 tokens.
  5. Enable or disable adding liquidity to the pool using the function setSwapAndLiquifyEnabled.

WorthTokenSale contract owner has rights to:

  1. Add users to the whitelist and set the maximum allocation amount (in USD).
  2. Close tokens sale calling function endSale(). Without ending the sale, users could not claim bought tokens.
  3. Withdraw all tokens from the contract using the function withdrawTokens including unclaimed users tokens.

2.2 allDepositIds is not necessary

null

Severity:

Note.
null

Description:

The allDepositIds array contains a sequence of id from 1 to depositId. So all deposits Ids are below or equal to depositId.

2.3 The Hard cap may be exceeded

null

Severity:

Note.
null

Description:

The Hard cap is checked before adding the amount the user sends to exchangeUSDTForToken and exchangeBUSDForToken. It may cause exceed the Hard cap if a user sends a bigger amount than left to reach the hard cap.

2.4 The owner can withdraw the user’s unclaimed tokens

null

Severity:

Low.
null

Description:

The function withdrawTokens allows the contract owner to withdraw the entire balance of the contract, including tokens that users bought but did not claim yet.

3. Security Practices

4. Conclusion

The audited smart contract can be deployed. Only low severity issues were found during the audit.

Pay attention to WorthTokenSale contract owner rights that may hurt users.

It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract’s operability and prevent any issues that are not directly related to the code of this smart contract.

About Callisto Network

Founded by Dexaran,  co-founder of Ethereum Classic, Callisto Network is a blockchain platform that prioritizes security. We’ve conducted over 330 smart contract audits across platforms like Ethereum, Ethereum Classic, and EOS. In addition to our audits, we’ve developed the ERC 223 token standard and CallistoNFT standard, enhancements over existing standards that address flaws and offer new capabilities, further establishing us as industry leaders in crypto-security.

Trust the Blockchain, Audit Your Smart Contracts.