Read the findings of the 2022 Web3 Security Report

All of the DataGen tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute DataGen tokens without obtaining the consensus of the community.

```js==
 27     constructor () {
 28         // Initial Minting to Owner
 29         _balances[msg.sender] = 30000000 * (10 ** 18);
 30         _totalSupply = 30000000 * (10 ** 18);
 31     }
```

Initial Token Distribution

In the contract `TeamBonusPool` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and sendBonus arbitrarily.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-TeamBonusPool-_owner.svg)

In the contract `ReservedPool` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set setCompanyWallet arbitrarily.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-ReservedPool-_owner.svg)


Centralization Risks

In the contract `DataGen` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and burn an arbitrary amount token from any address.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-DataGen-_owner.svg)

In the contract `MiningReservation` the role `stakerAddr` has authority over the functions shown in the diagram below.

Any compromise to the `stakerAddr` account may allow the hacker to take advantage of this authority and modify critical configurations of the contract.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-MiningReservation-stakerAddr.svg)

In the contract `VCPrivateSale` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw tokens.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-VCPrivateSale-_owner.svg)

In the contract `TeamMainPool` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and send any number of salaries to any address.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c9080d2c06d5438f8c4167e2bd52bc02/diagrams/centralization-TeamMainPool-_owner.svg)

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of a proper ERC-20 implementation.

Unchecked Value of ERC-20 `transfer()`/`transferFrom()` Call

Solidity integer division might truncate. As a result, performing multiplication before division can sometimes avoid loss of precision.

Divide Before Multiply

No token is transferred to the contract when function `sendBonus()` and `sendSalary()` is called.


No token transferred 

There is a call inside a loop in mentioned functions which might lead to a denial-of-service attack.
The attackers may launch a Denial-of-Service (DoS) attack via a large number of loops.


Potential DOS attack

The if-else branch is not completed.

```js==
288         if (winnerInfo == 1) {
289             setMiningLogicManagerAddress(tempAddr, tempPercent);
290             emit getWinnerInfo(
291                 winnerInfo,
292                 tempAddr,
293                 tempPercent
294             );
295         }
296         else if (winnerInfo == 2) {
297             setMiningLogicManagerAddress(
298                 newMiningLogicManagerAddress,
299                 new_percent
300             );
301             emit getWinnerInfo(
302                 winnerInfo,
303                 newMiningLogicManagerAddress,
304                 new_percent
305             );
306         }
```

Completion of if-else Branch

The function releaseDataGen() will release dataGen token to `MiningLogicManagerAddress` which is set to `newMiningLogicManagerAddress` by function `setMiningLogicManagerAddress()`.
```js==
134         MiningLogicManagerAddress = _newMiningLogicManagerAddress;
135         percent = _percent;
136         countMiningLogicManagerAddress = _percent.length;
```

And  `newMiningLogicManagerAddress` is set by the first staker with "stakeAmount > 100000 * 10**18" in function stake() :
```js==
171         if (
172             stakeAmount[msg.sender] >= 100000 * 10**18 && voteSetter == deadAddr
173         ) {
174             voteSetter = msg.sender;
175             votationStartTime = miningLogicInfo[msg.sender].voteStartTime;
176             votationDuration = 3600 * 24 * 30;
177             newMiningLogicManagerAddress = miningLogicInfo[msg.sender]
178                 .MiningLogicManagerAddress;
179             new_percent = miningLogicInfo[msg.sender].percent;
180         }

```

But if the next round vote started and a new winner is selected before `releaseDataGen()` be executed.
Then `MiningLogicManagerAddress` will be overwritten to `_newMiningLogicManagerAddress` set by new winner in function stake().
As a result, the old winner may lose his dataGen token rewards.


Old winner may lose rewards 

DataGen

TeamMainPool.sol

USDCtest.sol

ReservedPool.sol

VCPrivateSale.sol

B - Datagray

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

5

1

5