Note: This article was originally published under the Callisto Network blog. We are now evolving into Fushuma, a community-driven blockchain leveraging advanced ZK-Rollup technology for low fees and high throughput.
In Fushuma, FUMA token holders drive on-chain governance by making decisions on network upgrades and project funding. As the ecosystem grows, they are rewarded with tokens airdropped from funded initiatives.
Learn more about our transition and the exciting developments ahead for Fushuma here.
Trust Wallet Token Security Audit Report
Are Your Funds Safe?
Our expert team at Callisto Network has conducted an in-depth security audit of the Trust Wallet Token (TWT) smart contract. This audit aims to ensure the security of your funds by identifying and assessing any potential vulnerabilities. Here, we present our findings:
Executive Summary
This report presents the results of the security audit conducted by the Callisto Network Security Department on the Trust Wallet Token (TWT) smart contract in December 2021. It analyzes the contract’s security in-depth and highlights any identified vulnerabilities.
1. Scope of the Audit
The audit focused on the following Trust Wallet Token (TWT) contract:
2. Audit Findings
Our audit reported a total of 1 finding(s), categorized as follows:
- 0 high-severity issue(s).
- 0 medium severity issue(s).
- 1 low-severity issue(s).
No critical security issues were found.
2.1 Admin privileges
Severity: Low.
Description:
The contract lacks a transaction handling mechanism. WARNING! This common vulnerability has already led to significant financial losses. For a comprehensive understanding of this issue, click here.
Recommendation:
Add the following code to the
transfer(_to address, ...)function:require( _to != address(this) );
3.Security Practices
✅ Open-Source Contract: The contract's source code should be accessible for public scrutiny.
❌ Bug Bounty Program: Initiating a bug bounty program post-audit for comprehensive security validation is recommended.
✅ Public testing: The contract should undergo public testing to detect unforeseen bugs or issues.
❌ Multi-signature Owner Account: A multi-signature setup for owner accounts is recommended for additional security layers.
❌ Standard ERC20-Related Issues: Not Implemented. It is known that a smart contract, even if not designed to receive or hold tokens, can still inadvertently receive ERC20-token deposits, without the ability to reject them. Thus, it's recommended to incorporate a function that allows for the extraction of any number of such unintended tokens from the contract.
4. Conclusion
The audited smart contract can be deployed. Only low-severity issues were found during the audit.
It is recommended to adhere to the security practices described in pt. 4 of this report to ensure the contract’s operability and prevent any issues that are not directly related to the code of this smart contract.
