SlowMist: Analysis of Smart Contract Vulnerabilities and Remediation Methods for EduCoin (Released in 2018)
Huobi Pro made an announcement at 01:33 on May 24th regarding the upgrade of the official smart contract for EduCoin (EDU). The SlowMist security team conducted a detailed analysis after being alerted to a potential vulnerability in the EDU smart contract based on intelligence gathered by the “Slow Mist Zone”.
Vulnerability Analysis
In the EDU smart contract’s “transferFrom” function, there is no verification of whether “allowed[_from][msg.sender] >= _value” and the line “allowed[_from][msg.sender] -= _value;” does not use SafeMath. This causes an inability to throw an exception and roll back the transaction.
With this vulnerability, an attacker can transfer all the EDU in a specified account without needing the private key. Furthermore, since the contract lacks a Pause design, there is no way to stop the loss.
Repair Methods
To fix the vulnerability, either add “require(allowed[_from][msg.sender] >= _value);” on the line below “require(balances[_from] >= _value);” or introduce SafeMath by adding “using SafeMath for uint256;” to the contract. Also, modify “allowed[_from][msg.sender] -= _value;” to “allowed[_from][msg.sender] = allowed[_from][msg.sender].sub(_value);” to prevent the vulnerability from being exploited.
About SlowMist
SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.
Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/
