dmarket/dmarket-smartcontract

dmarket-smartcontract's Issues

[Security] First and Second Token Sale periods are redefinable by owner

I may be mistaken, but as far as I can see the first or second step sales are repeatable — the first step times could easily be "reset" after the first set has ended, to create another "first phase sale".

https://github.com/suntechsoft/dmarket-smartcontract/blob/master/contracts/DMTokenContract.sol#L61

[Clarity] Variable typo in DMTokenContract?

Not sure how this got overlooked, since all of the code in DMTokenContract.sol seems to use starSecondStep which I assume is an accidental typo?

https://github.com/suntechsoft/dmarket-smartcontract/blob/master/contracts/DMTokenContract.sol#L56

[Security] Total supply limit not enforced?

I can't find anything in the code that limits the total supply to 50,000,000. The totalSupply variable is set, but I can't find code enforcing it or keeping track of the remaining undistributed amount?

I also can't find code enforcing the following statement that's declared on your website:

"After the token sale is closed, 10% of the total token amount sold are issued and reserved for DMarket's core activities, and 5% is reserved for DMarket advisory board and partners."

[Security] Should tokenReserve not be internal?

Is allowing tokenReserve to be a public function a security flaw — otherwise unless I'm misunderstood anyone can call this function and add however much they please to their balance?

function tokenReserve(address _to, uint256 _value) returns (bool) {
    balances[_to] = balances[_to].add(_value);
    Transfer(msg.sender, _to, _value);
    return true;
}

https://github.com/suntechsoft/dmarket-smartcontract/blob/master/contracts/DMTokenContract.sol#L134