Read the findings of the 2022 Web3 Security Report

In function `buy()`:
```solidity=1650
    uint256 _fee = sale[_id].price.div(denominator).mul(fee);
```
When users put an ERC721 token on sale, the amount of ERC20 that they expect to receive is the sale price minus the current fee. However, if the fee is raised before someone buys the token, the seller will receive fewer ERC20 tokens than the amount when he listed it.  

Fee Can Be Changed After Posting A Sale Request

In function `buy()`:
```solidity=1651
      IERC20(sale[_id].c20).transferFrom(_msgSender(), sale[_id].seller, sale[_id].price.sub(_fee));
      IERC20(sale[_id].c20).transferFrom(_msgSender(), feeAddr, _fee);
```
Function `buy()` ignores return values by the function calls of `transferFrom()`.

Several tokens do not revert in case of failure and return false. The buyer could get the ERC721 token without paying ERC20 tokens.

Ignore Return Values

```solidity=1555
    interface IQbeinlicensing {
       function checkLicense(address _contract) external view returns (bool active);
    }
    
    contract Qbeinlicensing {
        address public licensingContract;
    
        constructor(address _license) {
            licensingContract = _license;
        }
    
        modifier isRunning {
            require(IQbeinlicensing(licensingContract).checkLicense(address(this)), 'License not active.');
            _;
        }
    }
```
The contract is serving as the underlying entity to interact with third party contract `licensingContract`. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to transaction failure since major functions in contract `AMCmarketplace` are guarded by the modifier `isRunning`.

Third Party Dependencies

```solidity=1674
    function changeFee(uint256 _fee, uint256 _denominator, address _feeAddr) external isRunning {
        require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "You must have admin role to change fee.");
        require(_denominator >= _fee, "Fee is more than denominator.");
        fee = _fee;
        denominator = _denominator;
        feeAddr = _feeAddr;
        emit ChangeFee(_fee, _denominator, _feeAddr);
    }
```
There is no upper limit restricting parameter `_fee` of `changeFee()` potentially enabling up to 100% fees on transactions.

No Upper Limit for `fee`

Function `ChangeFee()` does not check if address `_feeAddr` is 0.

Missing Input Validation

```solidity=1624
    function sell(address _contract721, address _contract20, uint256 _tokenId, address _from, uint256 _price) external isRunning returns (uint256 _id) { 
        IERC721(_contract721).safeTransferFrom(_from, address(this), _tokenId);
        require(_price != 0, "Price cannot be zero.");
        require(_price % denominator == 0, "Price in wei must be a multiple of denominator. Remember the decimals.");
        require(contractsWhitelist.contains(_contract721), "ERC721 contract is not in whitelist.");
        require(contractsWhitelist.contains(_contract20), "ERC20 contract is not in whitelist.");
        sellId = sellId.add(1);
        onSale = onSale.add(1);
        idByToken[_contract721][_tokenId] = sellId;
        sale[sellId] = Sales(_msgSender(), address(0), _contract721, _contract20, _tokenId, _price, true);
        emit Sell(sellId, _tokenId, _price, _from, _contract721, _contract20);
        return sellId;
    }
```

The function `sell()` calls external function `IERC721(_contract721).safeTransferFrom()` before checking if `contractsWhitelist` contains `_contract721`.

Arbitrary External Call

```solidity=1634
    function addToWhitelist(address _contract) external {
        require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "You must have admin role to add contract to whitelist.");
        require(_contract.isContract(), "Address is not a contract.");
        require(contractsWhitelist.add(_contract), "Contact is already in whitelist.");
        emit ChangeContractWhiteList(_contract, true);
    }

    function removeFromWhitelist(address _contract) external {
        require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "You must have admin role to remove contract from whitelist.");
        require(contractsWhitelist.remove(_contract), "Where is no such contract in whitelist.");
        emit ChangeContractWhiteList(_contract, false);
    }
    
    function changeFee(uint256 _fee, address _feeAddr) external {
        require(hasRole(DEFAULT_ADMIN_ROLE, _msgSender()), "You must have admin role to change fee.");
        require(_fee <= 300, "Fee cannot be more than 30%.");  // 30%, denominator is constant 1000
        require(_feeAddr != address(0), "Wrong fee address.");
        fee = _fee;
        feeAddr = _feeAddr;
        emit ChangeFee(_fee, _feeAddr);
    }
```

In the contract `AMCmarketplace` the role `DEFAULT_ADMIN_ROLE` has authority over the functions above.

Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority, remove contracts from the white list, change fee rates, and/or change the fee receiver.

Centralization Related Risks

Axes Metaverse

0x87fa9690b5817dd90492272e659d2f3c3e079ae7

AMCmarketplace.sol

0xece4cd3b324c40144ca153f67b998c56e3de8be2

m.sol

Axes Metaverse 

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Crypto Flipsider News – Binance Adds Apple Pay; Ethereum 2022 Roundup; SOL Falls 97%; Turkey CNBC Test; FBI Probing 3Commas

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

FTX Token price risks 30% plunge as a 23M FTT 'part' moves to Binance - Crypto Capital Today

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Crypto Flipsider News – Bitcoin (BTC) Drops; Lightning Network Bug; Binance Buy Banks; Robinhood’s Revenue Falls; Alameda Illiquid Assets

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

FTX's Sam Bankman-Fried Tells Binance CZ "You Won," Here's What Happened

Binance confirms it's backing out of deal to buy FTX assets - MarketWatch

Singapore defends its treatment of Binance after FTX ‘debacle’

Crypto News Summary: Binance Launches Oracle, UvToken and Team Finance Exploited, Blockchain.com Debuts Visa Card

Axes Metaverse

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

7

0

1

0

6