Refundable Crowdsale

[cwhinfrey]

🎉 Description

The current implementation of RefundableCrowdsale refunds the original purchaser if the goal is not met. However, tokens can be transferred instantly. This opens up refundable crowdsales that do not meet their goal to the following attack:

1. The attacker purchases tokens from the crowdsale.
2. The attacker sees that the goal is unlikely to be met and sells the tokens to a naive user (possibly at a discount).
3. The goal is not met and the attacker's ETH is refunded while the naive user is left with worthless tokens.

This could be prevented by pausing token transfers until the goal is reached or until the crowdsale is finalized.

It is also possible that refunds could be given as tokens are returned but it would greatly complicate the crowdsale when presale allocations and bonuses are involved.

🐛 This is a bug report.

[frangio]

Thanks for the detailed report @cwhinfrey! We will look into it.

[frangio]

Since the suggested change breaks the API (yes we should have done this before 2.0), @nventuro suggested to create a new one that is Refundable + PostDelivery, and to deprecate the current one.