Security suggestions to mitigate risk while running an ICO
Note: Some of these steps are relevant only for ICOs with ERC20 token. While rest are applicable to all ICOs. Secondly, this list might not be exhaustive and is not intended to fully replace a security specialists services for your ICO.
Below is list of some potential frauds and suggested mitigating measures for that risk:
1) Potential Fraud: Very common fraud is misleading your ICO participants transfer ethers to fraudster’s account instead of your company’s recipient smart contract address
Mitigation Suggestions:
a) Your ICO user procedure shouldn’t involve receiving intimation of recipient smart contract address via insecure channels like email/social media. Phishing attempts giving fraudsters account address are very common thru these channels. Even publishing the address on slack page of your company/website has risk of fraudsters hacking those sites and putting fraudsters account address there. Use more secure channels. Eg: ask user to login to your ICO portal to see the smart contract address; and keep monitoring those channel(s) for hacks and published address tampering. Educate your ICO participants to not trust address intimation received thru any other channel
b) Make the smart contract address intimation available thru second secure channel and educate participants to cross verify the smart contract address they are using across these 2 channels.
c) If your smart contract design involves the recipient smart contract address being owner of your token contract, then this is one more way users can verify the smart contract address. Token contract ownership can be seen in blockexplorer sites like etherscan.io for ethereum tokens
d) setup SSL certificate for your company website and ICO portal site; publicize to your participants to only trust these sites that too after SSL certificate based verification by their browser. Publicise that your company doesn’t have any other website and they shouldn’t follow any other website even if it looks like yours.
e) protect emailids of your ICO participants with utmost care. If they fall in hands of fraudsters, they can do email phishing attempts to mislead participants to send ethers to fraudster’s address
f) Ensure that email accounts of your CEO, CXO, VPs are well protected with 2 factor authentication etc. Lot of issues will be created if one of those accounts is hacked.
g) Keep monitoring you website, webapp, social media channels very frequently to detect hacks if any.
2) Potential Fraud: Exploiting vulnerabilities in smart contract code to siphon off money from the smart contract account.
Mitigation Suggestions:
a) Ensure that security best practices are diligently followed during coding; Validate the same during code review and testing of the smart contracts.
b) Be watchful while using third party libraries; If they have any security vulnerabilities your contract will inherit them and you won’t be aware of it till a hack occurs.
c) The smart contract can immediately move the ethers raised from token sale into company’s account as part of the sale transaction itself. This means if sale cancellation/refund is to be done later for participants that fail KYC or AML restrictions, that time explicitly ethers should be moved from company account to contract account. i.e the contract should be coded to accept ethers in non-token sale transactions also.
d) If adequate time is available, another option is to publish to code offering bug bounties to ethical hackers that identify security holes and inform you.
3) Potential Fraud: Hacking the company account’s private key and transferring out the ethers raised in the token sale.
Mitigation Suggestions:
a) Consider measures like using hardware wallet to store the private key.
b) Consider transferring the raised funds into other company accounts to spread out.
