Smart Contract Security Audit

A security audit of a Solidity contract, with a written report and a fixed version of the code. The review found one critical, one medium and two informational issues.

The critical finding: the contract declared a struct variable without initialising it. In Solidity 0.4 that creates an uninitialised storage pointer, so writing to it overwrote storage slot 0, which held the contract's owner. Any caller could take over the contract.

The fix points the struct at the caller's own mapping entry. The legacy contract-named constructor was replaced with a proper constructor, the owner was made publicly readable, and the code was upgraded from Solidity 0.4.23 to 0.8.