DittoETH

Summary

Validation using assert

Vulnerability Details

Contracts use assert() instead of require() in multiple places. This causes a Panic error on failure and prevents from applying error messages.

Impact

Solidity docs clearly mentioned that:

"Assert should only be used to test for internal errors, and to check invariants. Properly functioning code should never create a Panic, not even on invalid external input. If this happens, then there is a bug in your contract which you should fix. Language analysis tools can evaluate your contract to identify the conditions and function calls which will cause a Panic.”

Tools Used

Manual code Review

Recommendations

Use require() with clear error message instead of assert().