ton-blockchain/bridge-solidity

TON-EVM Toncoin bridge - Solidity smart contracts

bridge-solidity's Issues

No overflow/underflow checks for numbers. Critical exploitation not found

The solidity version 0.7.4 does not automatically check numbers for overflows/underflows.

There are 3 places in the bridge solidity code that are potentially not checked for overflows:

Method increaseAllowance

bridge-solidity/contracts/ERC20.sol

Line 169 in 652e0e9

_approve(msg.sender, spender, _allowances[msg.sender][spender] + addedValue);

Since this method can only be called by the account owner himself, there is no critical exploitation.

Method _transfer

bridge-solidity/contracts/ERC20.sol

Line 218 in 652e0e9

_balances[recipient] += amount;

The initial emission of Toncoins is 5 billion (5^18 in nanocoins).
The emission of Toncoins from validation are equal to about a few percent per year of the total emission.
The balance is stored in 256-bit uint with max number 2^256 – 1 ~ 1e77
Thus, in a real situation, overflow cannot occur.

Method _mint

bridge-solidity/contracts/ERC20.sol

Line 237 in 652e0e9

_totalSupply += amount;

bridge-solidity/contracts/ERC20.sol

Line 238 in 652e0e9

_balances[account] += amount;

The mint method can be only invoked by quorum of bridge oracles.

Bridge oracles work according to the rule - if N TONCOINS are minted in the Ethereum/BSC network, then N native Toncoins must be locked in the TON network before.

Due to the reason described in the previous paragraph, overflow cannot happen in real life.

Conclusion

Despite the fact that there are no critical exploitation, in the next versions of the contract it would be good for us to use the solidity version 8+ or use the SafeMath library.