uups-checker 1.0.0

package/audits/DecompiledERC20-security-audit-20260325.md

@@ -0,0 +1,397 @@
+# Decompiled ERC20 Token Security Audit
+
+**Date**: March 25, 2026  
+**Auditor**: Security Researcher  
+**Contract**: Decompiled ERC20 (Unknown Address)  
+**Solidity Version**: 0.8.7  
+**Source**: Decompiled bytecode  
+**Focus**: USER-EXPLOITABLE VULNERABILITIES ONLY
+
+---
+
+## ⚠️ CRITICAL WARNING
+
+This is a DECOMPILED contract from bytecode. The variable names and some logic may not match the original source code. Decompilation can introduce artifacts and misinterpretations.
+
+---
+
+## Executive Summary
+
+**Overall Assessment**: ✅ NO OBVIOUS USER-EXPLOITABLE VULNERABILITIES
+
+However, there are several RED FLAGS and suspicious patterns that warrant deeper investigation:
+
+1. ⚠️ All functions are marked `payable` (unusual for ERC20)
+2. ⚠️ Confusing variable naming (`_increaseAllowance` used for allowances mapping)
+3. ⚠️ No mint/burn functions visible (how are tokens created?)
+4. ⚠️ Decompiled code may hide malicious logic
+
+---
+
+## Contract Analysis
+
+### Architecture
+
+```
+DecompiledERC20
+├── Storage:
+│   ├── _balanceOf (balances)
+│   ├── _increaseAllowance (allowances) ⚠️ CONFUSING NAME
+│   ├── _totalSupply
+│   ├── _name
+│   └── _symbol
+└── Functions:
+    ├── Standard ERC20 (transfer, approve, etc.)
+    └── All marked payable ⚠️ UNUSUAL
+```
+
+---
+
+## Vulnerability Analysis
+
+### 1. 🚨 ALL FUNCTIONS ARE PAYABLE
+
+**Finding**: Every function including `transfer()`, `approve()`, `balanceOf()` is marked `payable`.
+
+**Code**:
+```solidity
+function transfer(address recipient, uint256 amount) public payable returns (bool)
+function balanceOf(address account) public payable returns (uint256)
+function decimals() public payable returns (uint8)
+```
+
+**Why This Is Suspicious**:
+- Standard ERC20 functions should NOT be payable
+- Allows users to accidentally send ETH with token transfers
+- ETH sent to contract would be STUCK (no withdrawal function)
+
+**Potential Exploit**:
+- Users lose ETH by sending it with transactions
+- Contract accumulates ETH with no way to retrieve it
+
+**Assessment**: 
+- ⚠️ UNUSUAL but not directly exploitable
+- 🔴 ETH TRAP - Users can lose ETH
+
+**User Exploitability**: MEDIUM - Users lose their own ETH, not steal others'
+
+---
+
+### 2. 🚨 CONFUSING VARIABLE NAMING
+
+**Finding**: The allowances mapping is named `_increaseAllowance` instead of `_allowances`.
+
+**Code**:
+```solidity
+mapping (address => mapping (address => uint256)) public _increaseAllowance;
+```
+
+**Why This Is Suspicious**:
+- Decompiler may have misnamed it
+- OR original code intentionally obfuscated
+- Makes code review difficult
+
+**Assessment**:
+- ⚠️ Confusing but functionally correct
+- May indicate obfuscation attempt
+
+**User Exploitability**: NONE - Just poor naming
+
+---
+
+### 3. ❓ NO MINT/BURN FUNCTIONS
+
+**Finding**: No visible functions to mint or burn tokens.
+
+**Questions**:
+- How were tokens initially created?
+- Is there a hidden mint function?
+- Is total supply fixed?
+
+**Possibilities**:
+1. Tokens minted in constructor (not visible in decompiled code)
+2. Hidden mint function with different selector
+3. Upgradeable proxy pattern
+
+**Assessment**: 
+- ⚠️ UNKNOWN - Cannot determine without full bytecode analysis
+- Could hide admin functions
+
+**User Exploitability**: UNKNOWN - Need to check actual contract
+
+---
+
+### 4. ✅ TRANSFER LOGIC APPEARS SAFE
+
+**Code**:
+```solidity
+function _transfer(uint256 varg0, address varg1, address varg2) private {
+    require(varg2 != address(0), "ERC20: transfer from the zero address");
+    require(varg1 != address(0), "ERC20: transfer to the zero address");
+    require(_balanceOf[varg2] >= varg0, "ERC20: transfer amount exceeds balance");
+    _balanceOf[varg2] = _balanceOf[varg2] - varg0;
+    uint256 v0 = _SafeAdd(_balanceOf[varg1], varg0);
+    _balanceOf[varg1] = v0;
+    emit Transfer(varg2, varg1, varg0);
+}
+```
+
+**Assessment**:
+- ✅ Checks for zero addresses
+- ✅ Checks sufficient balance
+- ✅ Uses SafeAdd for recipient balance
+- ✅ Emits Transfer event
+
+**User Exploitability**: NONE - Standard safe transfer
+
+---
+
+### 5. ✅ APPROVAL LOGIC APPEARS SAFE
+
+**Code**:
+```solidity
+function _approve(uint256 varg0, address varg1, address varg2) private {
+    require(varg2 != address(0), "ERC20: approve from the zero address");
+    require(varg1 != address(0), "ERC20: approve to the zero address");
+    _increaseAllowance[varg2][varg1] = varg0;
+    emit Approval(varg2, varg1, varg0);
+}
+```
+
+**Assessment**:
+- ✅ Checks for zero addresses
+- ✅ Standard approval logic
+- ✅ Emits Approval event
+
+**User Exploitability**: NONE - Standard safe approval
+
+---
+
+### 6. ✅ SAFEMATH IMPLEMENTATION
+
+**Code**:
+```solidity
+function _SafeAdd(uint256 varg0, uint256 varg1) private pure returns (uint256) {
+    require(varg0 <= type(uint256).max - varg1, "Panic(17)");
+    return varg0 + varg1;
+}
+```
+
+**Assessment**:
+- ✅ Prevents overflow
+- ✅ Solidity 0.8.7 has built-in overflow protection anyway
+- ✅ Redundant but safe
+
+**User Exploitability**: NONE - Overflow protected
+
+---
+
+### 7. ⚠️ FALLBACK REVERTS
+
+**Code**:
+```solidity
+fallback() external payable {
+    revert();
+}
+```
+
+**Assessment**:
+- ✅ Prevents accidental ETH sends to contract
+- ⚠️ BUT all functions are payable, so ETH can still be sent
+- 🔴 ETH sent via function calls will be STUCK
+
+**User Exploitability**: MEDIUM - Users can lose their own ETH
+
+---
+
+## Hidden Function Analysis
+
+**Concern**: Decompiled code may not show all functions.
+
+**To Check**:
+1. Get actual contract address
+2. Check bytecode for hidden selectors
+3. Look for proxy patterns
+4. Check for owner/admin functions
+
+**Potential Hidden Functions**:
+- `mint(address, uint256)` - Could allow unlimited minting
+- `burn(address, uint256)` - Could burn user tokens
+- `pause()` - Could freeze transfers
+- `setFee()` - Could add transfer fees
+- `blacklist()` - Could block addresses
+
+**Recommendation**: MUST verify actual deployed contract
+
+---
+
+## Attack Vectors Analyzed
+
+### ❌ Integer Overflow
+**Attempt**: Overflow balances  
+**Result**: SafeAdd prevents overflow  
+**Exploitable**: NO
+
+### ❌ Reentrancy
+**Attempt**: Reenter during transfer  
+**Result**: No external calls in transfer  
+**Exploitable**: NO
+
+### ❌ Zero Address Transfers
+**Attempt**: Transfer to/from address(0)  
+**Result**: Blocked by require statements  
+**Exploitable**: NO
+
+### ⚠️ ETH Trap
+**Attempt**: Send ETH with function calls  
+**Result**: ETH stuck in contract  
+**Exploitable**: YES - Users lose their own ETH
+
+### ❓ Hidden Mint Function
+**Attempt**: Call hidden mint function  
+**Result**: UNKNOWN - Need actual contract  
+**Exploitable**: UNKNOWN
+
+---
+
+## Red Flags Summary
+
+| Issue | Severity | Exploitable |
+|-------|----------|-------------|
+| All functions payable | MEDIUM | Users lose ETH |
+| Confusing variable names | LOW | No |
+| No visible mint/burn | UNKNOWN | Unknown |
+| Decompiled code | HIGH | May hide exploits |
+| ETH can be trapped | MEDIUM | Users lose ETH |
+
+---
+
+## Comparison with Standard ERC20
+
+| Feature | This Contract | Standard ERC20 |
+|---------|---------------|----------------|
+| Payable functions | ✅ All | ❌ None |
+| SafeMath | ✅ Yes | ✅ Yes (0.8+) |
+| Zero address checks | ✅ Yes | ✅ Yes |
+| Mint/Burn visible | ❌ No | Varies |
+| Variable naming | ⚠️ Confusing | ✅ Clear |
+
+---
+
+## Recommendations
+
+### Critical
+
+1. **GET ACTUAL CONTRACT ADDRESS**
+   - Cannot fully audit without knowing deployed address
+   - Need to check for hidden functions
+   - Verify bytecode matches decompiled code
+
+2. **CHECK FOR HIDDEN FUNCTIONS**
+   ```bash
+   cast sig-collision "mint(address,uint256)"
+   cast sig-collision "burn(address,uint256)"
+   cast sig-collision "pause()"
+   ```
+
+3. **VERIFY NO PROXY PATTERN**
+   - Check if contract is upgradeable
+   - Look for delegatecall usage
+   - Verify storage layout
+
+### High
+
+4. **REMOVE PAYABLE FROM FUNCTIONS**
+   - Standard ERC20 functions should not be payable
+   - Prevents users from losing ETH
+
+5. **ADD ETH WITHDRAWAL FUNCTION**
+   - If functions must be payable, add rescue function
+   - Prevents ETH from being stuck
+
+### Medium
+
+6. **FIX VARIABLE NAMING**
+   - Rename `_increaseAllowance` to `_allowances`
+   - Improves code clarity
+
+---
+
+## Testing Recommendations
+
+If you have the contract address, run these tests:
+
+```javascript
+// 1. Check for hidden functions
+const selectors = await getAllFunctionSelectors(contractAddress);
+
+// 2. Try to send ETH
+await contract.transfer(recipient, amount, {value: ethers.utils.parseEther("1")});
+// Check if ETH is stuck
+
+// 3. Check for owner
+try {
+    await contract.owner();
+} catch {}
+
+// 4. Check for pause
+try {
+    await contract.paused();
+} catch {}
+
+// 5. Check for mint
+try {
+    await contract.mint(attacker, ethers.utils.parseEther("1000000"));
+} catch {}
+```
+
+---
+
+## Conclusion
+
+**VERDICT**: ⚠️ SUSPICIOUS BUT NO OBVIOUS USER EXPLOITS
+
+**Visible Issues**:
+- ✅ Transfer logic appears safe
+- ✅ Approval logic appears safe
+- ✅ Overflow protection works
+- ⚠️ All functions payable (ETH trap)
+- ⚠️ Confusing variable names
+- ❓ No visible mint/burn functions
+
+**Hidden Risks**:
+- 🔴 Decompiled code may hide malicious functions
+- 🔴 Cannot verify without actual contract address
+- 🔴 May have hidden admin functions
+
+**Recommendation**: 
+- ⚠️ DO NOT USE without verifying actual deployed contract
+- ⚠️ Check for hidden functions
+- ⚠️ Verify no proxy/upgrade pattern
+- ⚠️ Test on testnet first
+
+**Risk Level**: MEDIUM-HIGH (due to unknowns)
+
+---
+
+## What We Need
+
+To complete this audit, provide:
+1. ✅ Contract address on mainnet/testnet
+2. ✅ Original source code (if available)
+3. ✅ Deployment transaction
+4. ✅ Any documentation
+
+**Current Status**: INCOMPLETE - Need actual contract to verify
+
+---
+
+## Disclaimer
+
+This audit is based on DECOMPILED bytecode which may not accurately represent the original source code. Decompilation can:
+- Miss hidden functions
+- Misinterpret logic
+- Hide malicious code
+- Show incorrect variable names
+
+**DO NOT TRUST THIS CONTRACT** without verifying the actual deployed bytecode and testing thoroughly.