Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

In the contract `AuctionData` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-AuctionData-_owner.svg)


In the contract `AuctionData` the roles in mapping `_exchanges` have authority over the functions listed below.

- function `setSaleOffer()`
- function `deleteSaleOffer()`
- function `setInvalidSignature()`

Any compromise to the accounts `_exchanges` may allow the hacker to take advantage of this authority.


-----
In the contract `BMAuctionBase` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMAuctionBase-_owner.svg)

In the contract `BMAuctionBase` the role `isInBlacklist` has authority over the functions listed below.

- function `setERC721Contract()`
- function `setERC1155Contract()`

-----
In the contract `BMBase` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMBase-_owner.svg)


-----
In the contract `BMERC1155` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMERC1155-_owner.svg)


-----
In the contract `BMERC1155URIStorage` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMERC1155URIStorage-_owner.svg)


-----
In the contract `BMERC721` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMERC721-_owner.svg)


-----
In the contract `BMRevenueManager` the role `isAuthorizer` has authority over the functions shown in the diagram below.

Any compromise to the `isAuthorizer` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-BMRevenueManager-isAuthorizer.svg)

-----
In the contract `ERC2981` the role `_exchanges` has authority over the functions shown in the diagram below.

Any compromise to the `_exchanges` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-ERC2981-_exchanges.svg)

In the contract `ERC2981` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-ERC2981-_owner.svg)


-----
In the contract `Logger` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2e63e500fd4e4ad7880bb2c58df253cf/diagrams/centralization-Logger-_owner.svg)


Centralization Risk

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

```solidity=29
modifier isInBlacklist() {
  require(!_blacklist[msg.sender], "Err: Caller is restricted");
  _;
}
```

Based on the modifier `isInBlacklist()`, any address which is never maintained by the `owner` can pass this `require` validation. That means any accounts can modifier the values of `erc721Contracts[]` and `erc1155Contracts[]`.

Missing Sanity Checks

The `_owner` of the contract has permission to modify the fees without limitation.   

Therefore, in the extreme case, that fee could be a very large amount of value, which might cause unexpected loss to the project and users.

Lack of Specified Rate Range Restriction

The function is named “changeURI”, which literally means that the function is used to change the state variable `_uri`. But the logic of this function is declared to change the CID for a token. 

Meanwhile, this function and function `setTokenCID` do exactly the same thing.

Inconsistent Naming And Action

The declaration of function `_addInvalidSigns()` is following :

```solidity=277
function _addInvalidSigns(address nftContract, bytes memory signs, bool isSeller) private {
```

Since the third parameter is named "isSeller", it is easy to assume that if `signs` is seller's signature, then the value of `isSeller` is true, and if it is not a seller's signature, then `isSeller` should be false.

But in line 162, `isSeller` is set to true event the `signs` is offer's signature.

```solidity=162
_addInvalidSigns(nftContract, model.offerSignature, true);
```

Incorrect Passed-in Value

In function `_cancelNFT()` following `if` branch is declared :
```solidity=157
if (compareStrings(model.currency, "cancelListing")) {
  _addInvalidSigns(nftContract, model.sellerSignature, true);
} else if (compareStrings(model.currency, "cancelMyOffer")) {
  require(!(_data.getInvalidSignature(model.offerSignature)), "Err: Offerer signature invalid");
}
```

According to the usage of private function `_cancelNFT()` in `cancelListing()` and `cancelMyOffer()`, the last string type parameter will be set as "cancelListing" or "cancelMyOffer", and the variable `NFTModel.currency` used for comparing is used to store which crypto currency is used in the transaction.

```solidity=127
_cancelNFT(nftContract, tokenId, seller, offerer, "cancelListing");
```
```solidity=142
_cancelNFT(nftContract, tokenId, seller, offerer, "cancelMyOffer");
```
```solidity=145
function _cancelNFT(address nftContract, uint256 tokenId, address seller, address offerer, string memory _t) private {
```

Therefore, parameter `_t` should be used for comparing in `if` branch.


Incorrect Parameter Used

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The return value of an external call is not stored in a local or state variable.

Unused Return Value

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The given input is missing the check for the non-zero address.

Missing Zero Address Validation

The aforementioned lines perform a low level call to execute transactions but the return value is not checked in either case.

Unchecked Value of Low-level Call

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

In `exchange/log/Logger.sol`

The function `Logger.withdraw()` is never used in this project. Even this function is specified as `external`, since modifier `isExchange` is declared, this function should not be called separately by a contract outside of the project `Bleem NFT`.


-----
In `exchange/BMAuctionBase.sol`

Function `BMAuctionBase.concatenate` is specified as `internal` but never used.


-----
In `token/ERC1155/BMERC1155.sol`

The function `BMERC1155.setTokenCID()` is never used in this project. Even this function is specified as `external`, since modifier `isExchange` is declared, this function should not be called separately by a contract outside of the project `Bleem NFT`.


Bleem NFT

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

3

0

11