Read the findings of the 2022 Web3 Security Report

In the contract `ATIDStaking` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-ATIDStaking-_owner.svg)

In the contract `ATIDStaking` the role `activePoolAddress` has authority over the functions shown in the diagram below.

Any compromise to the `activePoolAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-ATIDStaking-activePoolAddress.svg)

In the contract `ATIDStaking` the role `borrowerOperationsAddress` has authority over the functions shown in the diagram below.

Any compromise to the `borrowerOperationsAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-ATIDStaking-borrowerOperationsAddress.svg)

In the contract `ATIDStaking` the role `vaultManagerAddress` has authority over the functions shown in the diagram below.

Any compromise to the `vaultManagerAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-ATIDStaking-vaultManagerAddress.svg)

---

In the contract `ATIDToken` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-ATIDToken-_owner.svg)

---

In the contract `BAIToken` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-BAIToken-_owner.svg)

In the contract `BAIToken`, the role `borrowerOperationsAddresses` has authority over the following functions:
- mint()

In the contract `[BAIToken]`, the role `vaultManagerAddresses` has authority over the following functions:
- burn()
- returnFromPool()

In the contract `[BAIToken]`, the role `stabilityPoolAddresses` has authority over the following functions:
- burn()
- sendToPool()
- returnFromPool()

Any compromise to the `borrowerOperationsAddresses`, `vaultManagerAddresses`, and `stabilityPoolAddresses` accounts may allow the hacker to take advantage of this authority.

---

In the contract `CommunityIssuance` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-CommunityIssuance-_owner.svg)

---

In the contract `GovToken` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-GovToken-_owner.svg)

---

In the contract `LockupContractFactory` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/1e970e4a563e4698846eca5ca65acd70/diagrams/centralization-LockupContractFactory-_owner.svg)

Centralization Related Risks

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The contract is serving as the underlying entity to interact with third-party `colToken` protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The parameter variable `_lockedUntil` is unrestricted and can be the history time, is this in accordance with the design intent?

What is the rule for calling the `increaseF_COL()` and `increaseF_BAI()` functions? And this rule should be transparent to the community.

Discussion on the `ATIDStaking` contract

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

In the `unstakeLocked()` function, if an invalid locked stake ID is provided, such as 0, the user still gets their accumulated BAI and COL earnings.

But the comment on line 266 is "If this condition is false, the user is basically doing a fee top-up".

Is this consistent with the design intent?

Discussion on `unstakeLocked()`

The return value of the transfer()/transferFrom() call is not checked.

File: projects/AstridDao/contracts/ATID/ATIDStaking.sol (Line 244, Function `ATIDStaking.stakeLocked`)
```solidity
            baiToken.transfer(msg.sender, BAIGain);
```


---
File: projects/AstridDao/contracts/ATID/ATIDStaking.sol (Line 271, Function `ATIDStaking.unstakeLocked`)
```solidity
            atidToken.transfer(msg.sender, ATIDToWithdraw);
```


---
File: projects/AstridDao/contracts/ATID/ATIDStaking.sol (Line 280, Function `ATIDStaking.unstakeLocked`)
```solidity
        baiToken.transfer(msg.sender, BAIGain);
```


---
File: projects/AstridDao/contracts/ATID/CommunityIssuance.sol (Line 308, Function `CommunityIssuance.sendATID`)
```solidity
        atidToken.transfer(_account, _ATIDamount);
```


---
File: projects/AstridDao/contracts/ATID/LockupContract.sol (Line 101, Function `LockupContract.withdrawATID`)
```solidity
        atidTokenCached.transfer(beneficiary, amount);
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

Comparisons that are always true or always false may be incorrect. This means any user can call functions `sendATID()` and `issueATID()`.

File: projects/AstridDao/contracts/ATID/CommunityIssuance.sol (Line 314, Function `CommunityIssuance._requireCallerIsStabilityPool`)
```solidity
require(stabilityPoolAddressToCollateralID[msg.sender] >= 0, "CommunityIssuance: caller is not an SP");
```

Tautology or Contradiction

AstridDao

BAIToken.sol

ATIDStaking.sol

GovToken.sol

ATIDToken.sol

AstridDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

5

0

5