Read the findings of the 2022 Web3 Security Report

In the contract `AdventRobots` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority execute any of the following steps:

* Airdrop newly minted NFTs to any address while the total supply is less than the variable `maxSupply` by calling function `airdrop()`.
* Pause or unpause NFT minting during the presale or the regular sale at any moment by calling function `flipPausedState()`.
* Modify the revealed URI link with functions `reveal()`, `setBaseURI()` and `setURIsuffix()`.
* Modify the unrevealed URI link with function `setUnrevealedURI()`.
* Adjust the max supply and max pre-sale supply to any amount with functions `setMaxSupply()` and `setPresaleSupply()`.
* Adjust the cost of minting NFTs at pre-sale or regular sale to any amount with functions `setCost()` and `setPresaleCost()`.
* Adjust the amount of combined pre-sale and regular sale NFTs a single address can mint within 1 hour with function `setMaxMintAmountPerAddress()`
* Dictate which addresses will be able to participate in the white-listed NFT pre-sale with function `setWhitelistMerkleRoot()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/8f5399de320841e4b575b6f875d0cb46/diagrams/centralization-AdventRobots-_owner.svg)


Centralization Risk in `smart-contract.sol`

The inherited `Ownable` contract is missing the function `renounceOwnership()` which relinquishes ownership of the contract and potentially mitigates the centralized risks associated with the `onlyOwner` modifier. The `transferOwnership()` function also prevents setting the new owner to be the zero address by the **require** statement. 

Thus, the functions associated with the `onlyOwner` modifier are always able to be called since there would
always be a valid owner (See Finding: **ARC-04**).

Missing Function `renounceOwnership()`

In the function `airdrop()`, the for-loop is incorrectly calculating the variable `totalAmount`. The current logic  only adds the value of the first element in array `amounts` throughout each iteration of the for-loop.

```solidity=767
uint256 totalAmount;
for (uint256 i = 0; i < amounts.length; i++) totalAmount += amounts[0];`
```

Incorrect Logic In Function `airDrop()`

If function `setPresaleSupply()` is called to set state-variable `presaleSupply` to be less than the total amount of NFTs already minted, the mint functions `presaleMint()` and `mint()` will always revert and become temporarily locked.

The following scenario depicts the potential lock:
* The total amount of NFTs currently minted is 500
* The contract is still in the pre-sale phase (state-variable `onlyWhitelisted` is set to true)
* `setPresaleSupply()` is called, and sets `presaleSupply` to 400 (less than the total amount of NFTs already minted)

The function call to `presaleMint()` will revert due to the following `require` statement:

```solidity=749
  require(newSupply <= presaleSupply, "AdventRobots: presale token supply exceeded");
```
Since `presaleMint()` will never execute, the following `if` statement will never succeed: 

```solidity=759
  if (newSupply == presaleSupply) onlyWhitelisted = false;
```

Therefore, the function `mint()` will always revert due to the following `require` statement:

```solidity=733
  require(!onlyWhitelisted, "AdventRobots: minting currently in presale, use presale mint");
```
  

Potential Lock For Minting Functions

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The **assert** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The variable `revealed` is already set as `false` by default, hence the statement:
```solidity=713
	revealed = false;
```
in the constructor is redundant.

Redundant Statement

Advent Robots

smart-contract.sol

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Game On: Buried treasure games of 2022

Mega Matrix discontinues Mano game, alSpace platform due to regulatory issues

Hasbro Is 'Killing its Golden Goose' Card Game. BofA Downgrades To Sell.

Expert says the Patriot missiles are 'not a game changer.' Hear why

Crypto’s Game Plan After FTX’s Collapse

After Logan Paul's CryptoZoo game failed to let players

Robocallers have upped their scam game and they’re after your crypto

The SEC Chair Issued A Game-Changing Ethereum Warning—Sparking A Major Price Crash

Shiba Eternity Game: Australia Might Be "Last Test Location," Says SHIB Lead Dev

MetaMask Launches Bridge Aggregator to Move Tokens Across Blockchains – Game Changer?

Rally in Crypto Game Axie's AXS Token Faces Skepticism From Derivative Traders

BC.GAME is Hosting A Huge Lottery Event to Celebrate Argentina's Historic Win

Why crypto fraud is a game of whack-a-mole

‘It’s Not Priced In’—Crypto Braced For $300 Million Game-Changer As The Price Of Bitcoin, Ethereum, BNB, XRP, Solana, Cardano And Dogecoin Swing

first game from Shrike Tabletop is a tactical, ANTIFA-pu

Gala Games Buys Walking Dead Empires Game Studio, Token Surges 17%

Shiba Eternity Game Devs Now Accept Ideas from Users: Details

This CEO Claims SHIB Is Pyramid Scheme, John Deaton Shares Why SEC Is Wrong About XRP Status, Shiba Eternity Game Gets Upgrade: Crypto News Digest by U.Today

Advent Robots

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

8

0

1

0

7