Fix purchases bug and make finalize called only by owner

Author: AugustoL

contracts/LifCrowdsale.sol

@@ -229,7 +229,7 @@ contract LifCrowdsale is Ownable, Pausable {
 
     // store wei amount in case of TGE min cap not reached
     weiRaised = weiRaised.add(weiAmount);
-    purchases[beneficiary] = weiAmount;
+    purchases[beneficiary] = purchases[beneficiary].add(weiAmount);
     tokensSold = tokensSold.add(tokens);
 
     token.mint(beneficiary, tokens);
@@ -273,8 +273,11 @@ contract LifCrowdsale is Ownable, Pausable {
     // calculate the max amount of wei for the foundation
     uint256 foundationBalanceCapWei = maxFoundationCapUSD.mul(weiPerUSDinTGE);
 
-    // if the minimiun cap for the MVM is not reached transfer all funds to foundation
-    // else if the min cap for the MVM is reached, create it and send the remaining funds
+    // If the minimiun cap for the MVM is not reached transfer all funds to foundation
+    // else if the min cap for the MVM is reached, create it and send the remaining funds.
+    // We use weiRaised to compare becuase that is the total amount of wei raised in all TGE
+    // but we have to distribute the balance using `this.balance` because thats the amount
+    // raised by the crowdsale
     if (weiRaised <= foundationBalanceCapWei) {
 
       foundationWallet.transfer(this.balance);
@@ -398,6 +401,12 @@ contract LifCrowdsale is Ownable, Pausable {
     uint256 toReturn = purchases[contributor];
     assert(toReturn > 0);
 
+    uint256 tokenBalance = token.balanceOf(contributor);
+
+    // Substract weiRaised and tokens sold
+    weiRaised = weiRaised.sub(toReturn);
+    tokensSold = tokensSold.sub(tokenBalance);
+    token.burn(contributor, tokenBalance);
     purchases[contributor] = 0;
 
     contributor.transfer(toReturn);
@@ -409,7 +418,7 @@ contract LifCrowdsale is Ownable, Pausable {
      Mechanism in case the soft cap was exceeded. It also unpauses the token to
      enable transfers. It can be called only once, after `end2Timestamp`
    */
-  function finalize() public whenNotPaused hasEnded {
+  function finalize() public onlyOwner hasEnded {
     require(!isFinalized);
 
     // foward founds and unpause token only if minCap is reached

contracts/LifToken.sol

@@ -3,7 +3,6 @@ pragma solidity ^0.4.18;
 import "zeppelin-solidity/contracts/token/ERC827/ERC827Token.sol";
 import "zeppelin-solidity/contracts/token/ERC20/StandardToken.sol";
 import "zeppelin-solidity/contracts/token/ERC20/MintableToken.sol";
-import "zeppelin-solidity/contracts/token/ERC20/BurnableToken.sol";
 import "zeppelin-solidity/contracts/token/ERC20/PausableToken.sol";
 
 /**
@@ -12,9 +11,9 @@ import "zeppelin-solidity/contracts/token/ERC20/PausableToken.sol";
    Implementation of Líf, the ERC827 token for Winding Tree, an extension of the
    ERC20 token with extra methods to transfer value and data to execute a call
    on transfer.
-   Uses OpenZeppelin StandardToken, ERC827Token, BurnableToken, MintableToken and PausableToken.
+   Uses OpenZeppelin StandardToken, ERC827Token, MintableToken and PausableToken.
  */
-contract LifToken is StandardToken, ERC827Token, BurnableToken, MintableToken, PausableToken {
+contract LifToken is StandardToken, ERC827Token, MintableToken, PausableToken {
   // Token Name
   string public constant NAME = "Líf";
 
@@ -30,11 +29,34 @@ contract LifToken is StandardToken, ERC827Token, BurnableToken, MintableToken, P
    * @param _value The amount of tokens to be burned.
    */
   function burn(uint256 _value) public whenNotPaused {
-    super.burn(_value);
+
+    require(_value <= balances[msg.sender]);
+
+    balances[msg.sender] = balances[msg.sender].sub(_value);
+    totalSupply_ = totalSupply_.sub(_value);
 
     // a Transfer event to 0x0 can be useful for observers to keep track of
     // all the Lif by just looking at those events
     Transfer(msg.sender, address(0), _value);
   }
 
+  /**
+   * @dev Burns a specific amount of tokens of an address
+   * This function can be called only by the owner in the minting process
+   *
+   * @param _value The amount of tokens to be burned.
+   */
+  function burn(address burner, uint256 _value) public onlyOwner {
+
+    require(!mintingFinished);
+
+    require(_value <= balances[burner]);
+
+    balances[burner] = balances[burner].sub(_value);
+    totalSupply_ = totalSupply_.sub(_value);
+
+    // a Transfer event to 0x0 can be useful for observers to keep track of
+    // all the Lif by just looking at those events
+    Transfer(burner, address(0), _value);
+  }
 }

test/CrowdsaleGenTest.js

@@ -346,7 +346,33 @@ contract('LifCrowdsale Property-based test', function (accounts) {
         { 'type': 'waitTime', 'seconds': duration.days(1) },
         { 'type': 'buyTokens', beneficiary: 3, account: 4, eth: 23000 },
         { 'type': 'waitTime', 'seconds': duration.days(1) },
-        { 'type': 'finalizeCrowdsale', fromAccount: 5 },
+        { 'type': 'finalizeCrowdsale', fromAccount: 3 },
+      ],
+      crowdsale: {
+        rate1: 10,
+        rate2: 9,
+        setWeiLockSeconds: 3600,
+        foundationWallet: 2,
+        foundersWallet: 2,
+        owner: 3,
+      },
+    };
+
+    await runGeneratedCrowdsaleAndCommands(crowdsaleAndCommands);
+  });
+
+  it('Execute a normal TGE and ends with 0 funds', async function () {
+    let crowdsaleAndCommands = {
+      commands: [
+        { 'type': 'checkRate' },
+        { 'type': 'setWeiPerUSDinTGE', wei: 1500000000000000, fromAccount: 3 },
+        { 'type': 'waitTime', 'seconds': duration.days(1) },
+        { 'type': 'buyTokens', beneficiary: 3, account: 4, eth: 40000 },
+        { 'type': 'waitTime', 'seconds': duration.days(1) },
+        { 'type': 'buyTokens', beneficiary: 3, account: 4, eth: 23000 },
+        { 'type': 'waitTime', 'seconds': duration.days(1) },
+        { 'type': 'returnPurchase', fromAccount: 3, contributor: 3 },
+        { 'type': 'finalizeCrowdsale', fromAccount: 3 },
       ],
       crowdsale: {
         rate1: 10,
@@ -372,7 +398,7 @@ contract('LifCrowdsale Property-based test', function (accounts) {
         { 'type': 'waitTime', 'seconds': duration.days(1.1) },
         { 'type': 'buyTokens', beneficiary: 3, account: 4, eth: 60000 },
         { 'type': 'waitTime', 'seconds': duration.days(2) },
-        { 'type': 'finalizeCrowdsale', fromAccount: 5 },
+        { 'type': 'finalizeCrowdsale', fromAccount: 3 },
         { 'type': 'pauseToken', 'pause': false, 'fromAccount': 3 },
       ],
       crowdsale: {
@@ -625,7 +651,7 @@ contract('LifCrowdsale Property-based test', function (accounts) {
     await runGeneratedCrowdsaleAndCommands({
       'commands': [
         { 'type': 'fundCrowdsaleOverSoftCap', 'account': 8, 'softCapExcessWei': 15, 'finalize': true },
-        { 'type': 'returnPurchase', 'eth': 1, 'fromAccount': 0, 'contributor': 8 },
+        { 'type': 'returnPurchase', 'fromAccount': 0, 'contributor': 8 },
         { 'type': 'pauseToken', 'pause': false, 'fromAccount': 2 },
         { 'type': 'transfer', 'lif': 10, 'fromAccount': 8, 'toAccount': 2 },
       ],
@@ -644,7 +670,7 @@ contract('LifCrowdsale Property-based test', function (accounts) {
     await runGeneratedCrowdsaleAndCommands({
       'commands': [
         { 'type': 'fundCrowdsaleOverSoftCap', 'account': 8, 'softCapExcessWei': 15, 'finalize': true },
-        { 'type': 'returnPurchase', 'eth': 33, 'fromAccount': 0, 'contributor': 8 },
+        { 'type': 'returnPurchase', 'fromAccount': 0, 'contributor': 8 },
       ],
       'crowdsale': {
         'rate1': 23,

test/commands.js

@@ -275,6 +275,7 @@ async function runFinalizeCrowdsaleCommand (command, state) {
 
   let shouldThrow = state.crowdsaleFinalized ||
     state.crowdsalePaused || (state.weiPerUSDinTGE === 0) ||
+    (account !== gen.getAccount(state.owner)) ||
     hasZeroAddress ||
     (nextTimestamp <= state.crowdsaleData.end2Timestamp);
 
@@ -442,7 +443,7 @@ async function runClaimEthCommand (command, state) {
 async function runReturnPurchaseCommand (command, state) {
   let account = gen.getAccount(command.fromAccount),
     contributor = gen.getAccount(command.contributor),
-    purchases = _.filter(state.purchases, (p) => p.account === command.contributor),
+    purchases = _.filter(state.purchases, (p) => p.beneficiary === command.contributor),
     hasZeroAddress = (isZeroAddress(contributor) || isZeroAddress(account)),
     nextTimestamp = latestTime();
 
@@ -462,6 +463,15 @@ async function runReturnPurchaseCommand (command, state) {
       _.map(purchases, (p) => p.wei),
       (accum, wei) => accum.plus(wei)
     );
+
+    state.purchases = _.remove(state.purchases, function (p) {
+      return p.beneficiary !== command.contributor;
+    });
+
+    state.weiRaised = state.weiRaised.sub(returnedAmount);
+    state.totalSupply = state.totalSupply.sub(state.balances[command.contributor]);
+    state.balances[command.contributor] = 0;
+
     state = increaseEthBalance(state, command.contributor, returnedAmount);
     state = decreaseEthBalance(state, command.fromAccount, help.txGasCost(tx));
   } catch (e) {
@@ -614,7 +624,7 @@ async function runFundCrowdsaleBelowMinCap (command, state) {
         await increaseTimeTestRPCTo(state.crowdsaleData.end2Timestamp + 1);
       }
 
-      state = await runFinalizeCrowdsaleCommand({ fromAccount: command.account }, state);
+      state = await runFinalizeCrowdsaleCommand({ fromAccount: state.owner }, state);
 
       // verify that the crowdsale is finalized and funded
       assert.equal(true, state.crowdsaleFinalized);
@@ -650,7 +660,7 @@ async function runFundCrowdsaleBelowSoftCap (command, state) {
         await increaseTimeTestRPCTo(state.crowdsaleData.end2Timestamp + 1);
       }
 
-      state = await runFinalizeCrowdsaleCommand({ fromAccount: command.account }, state);
+      state = await runFinalizeCrowdsaleCommand({ fromAccount: state.owner }, state);
 
       // verify that the crowdsale is finalized and funded
       assert.equal(true, state.crowdsaleFinalized);
@@ -699,7 +709,7 @@ async function runFundCrowdsaleOverSoftCap (command, state) {
         await increaseTimeTestRPCTo(state.crowdsaleData.end2Timestamp + 1);
       }
 
-      state = await runFinalizeCrowdsaleCommand({ fromAccount: command.account }, state);
+      state = await runFinalizeCrowdsaleCommand({ fromAccount: state.owner }, state);
 
       // verify that the crowdsale is finalized and funded, but there's no MVM
       assert.equal(true, state.crowdsaleFinalized);