solidity-auditor

# Solidity Security Audit Report

## Contract Overview
**File:** `TokenSale.sol`
**Purpose:** ERC-20 token sale with staking functionality
**Lines Audited:** 1-156

---

## Critical Issues (Fix Immediately)

### 1. Reentrancy Vulnerability (Line 42-47)
**Severity:** Critical
**Location:** `buyTokens()` function
**Issue:** External call (`transfer`) occurs after state change (token minting).
```solidity
function buyTokens(uint256 amount) external payable {
    require(msg.value >= amount * tokenPrice, "Insufficient ETH");
    totalTokensSold += amount; // State change
    IERC20(token).transfer(msg.sender, amount); // External call
}
```
**Fix:** Use Checks-Effects-Interactions pattern. Move state change after the external call.

---

## High Issues

### 2. Integer Overflow Risk (Line 112)
**Severity:** High
**Location:** `stake()` function
**Issue:** No overflow protection for `stakedAmounts[msg.sender]`.
```solidity
stakedAmounts[msg.sender] += amount;
```
**Fix:** Use OpenZeppelin's `SafeMath` or Solidity 0.8+ built-in checks.

---

## Medium Issues

### 3. Centralization Risk (Line 78-82)
**Severity:** Medium
**Location:** `setTokenPrice()` function
**Issue:** Owner-only function with no timelock or multi-sig requirement.
**Fix:** Implement a 48-hour delay for critical parameters.

---

## Low Issues

### 4. Gas Inefficiency (Line 33-35)
**Severity:** Low
**Issue:** Unnecessary `public` visibility for `tokenPrice` variable.
**Fix:** Change to `private` or `internal`.

---

## Recommendations
- Add NatSpec comments for all functions
- Implement a circuit breaker pattern for emergency stops
- Use `immutable` for `tokenPrice` if it's set only once

**Overall Risk Score:** 7.2/10 (High Risk)
**Estimated Fix Time:** 3-5 days