Smart contract FT internal security audit

[sydhds]

Following the internal audit described here,

The following report has been written with few recommendations:

https://www.notion.so/massa-innoteam/FT-NFT-Contract-Audit-comments-0dd27b501ce44fcf9fbe131a7b6ebb8e?pvs=4#0385a7301ef442b89759faf6577b9f67

Recommendations

Code Coverage

1. Enable Code Coverage Reporting Automatically:
   • Implement automatic code coverage reporting in the as-pect.config.js file.
   • Ensure that code coverage is enabled as part of the Continuous Integration (CI) pipeline.

Dependencies

2. Update "semver" Package:
   • Upgrade the "semver" package to the latest version to address any potential vulnerabilities.
   • Integrate npm audit into the CI pipeline to automatically check for package vulnerabilities.

Code Security Checkup

root

3. Token Constructor Security:

   • Extract arguments from the constructor before setting them to Storage to prevent potential issues.

4. Safe Math Library Usage:

   • Use a safe math library for all (u256) token manipulation operations to prevent overflow vulnerabilities.

burnable

5. Burn Functions Security:

   • Ensure that burn functions check for overflow to prevent potential issues.

6. Unit Tests Enhancements:

   • In the ft.spec.ts unit test, check for transfer and allowance overflows.
   • In the ft-burn.spec.ts unit test, check for burn and decreaseTotalSupply overflows.
   • In the ft-mint.spec.ts unit test, verify that increase balance and supply do not overflow.

[Ben-Rey]

@peterjah @gregLibert FYI