Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

In the contract `BPADInfo` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/4a794264cf05457e9bc300c829d2412a/diagrams/centralization-BPADInfo-_owner.svg)

In the contract `BPADInfo` the role `bpadFactoryAddress` has authority over the functions shown in the diagram below.

Any compromise to the `bpadFactoryAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/4a794264cf05457e9bc300c829d2412a/diagrams/centralization-BPADInfo-bpadFactoryAddress.svg)

Centralization Risk in BPADInfo.sol

The given input is missing the check for the non-zero address.

Missing Input Validation

In the contract `BPADPool` the role `bpadFactoryAddress` has authority over the functions shown in the diagram below.

Any compromise to the `bpadFactoryAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/4a794264cf05457e9bc300c829d2412a/diagrams/centralization-BPADPool-bpadFactoryAddress.svg)

In the contract `BPADPool` the role `bpadOwnerAddress` has authority over the functions shown in the diagram below.

Any compromise to the `bpadOwnerAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/4a794264cf05457e9bc300c829d2412a/diagrams/centralization-BPADPool-bpadOwnerAddress.svg)

Centralization Risk in BPADPool.sol

Blockius Launchpad

BPADInfo.sol

BPADFactory.sol

BPADPool.sol

1. The contract `BPADInvFactory` can be used to create contract `BPADInvDash` and charge some fees. The owner of this contract can transfer fees to the specified address.
2. The `projectOwner` of the contract `BPADInvDash` can lock some tokens into the contract and specify beneficiary. The beneficiary can withdraw those tokens locked in the contract in stages. The `projectOwner` also can distribute tokens to the beneficiaries.

But, there still is a question we want to discuss:
As we can see in the contract `BPADInvDash`, the state variable `lockCount` presents the amount of `lockInfo`. The functions `transferLockById()` and `transferAllLock()` did not add a `lockInfo` into the contract but the `lockCount` was increased. It may make this variable meaningless. Pleas check.

Financial Models

```solidty
duration.sub(duration.div(periodicity).mul(periodicity)) == 0
```
The expression is just used to judge whether there exists remainder in the division. Use modulus will be better.

Modulus will be better

We don't know the scales of `beneficiaries` and `lockIds` of every `beneficiary`. We want to remind the project team to be cautious of the risk of `out-of-gas`.

Potential Out-of-Gas Exception

In the contract `BPADInvDash`, the role `BPADInvFactoryObj.owner` has the authority over the following function:
- emergencyWithdraw(): withdraw all the tokens in a specified `lock` to the specified `projectOwner`.
- setTokenOwner(): set the address of `projectOwner`.

Any compromise to the `BPADInvFactoryObj.owner` account may allow the hacker to take advantage of this and withdraw all the tokens.

Centralization Related Risks

Blockius Vesting

BPADInvFactory.sol

BPADInvDash.sol

Users can stake tokens into the contract `BPADMaturityStaking`. The rewards must be added to this contract before `withdrawStarts`. Otherwise the users can not get the rewards.

The amount of token in the transfer may be deducted by the token contract. So, the real amount of token may be different with the amount in the function.

Possible error amount

Blockius MaturityStaking

BPADMaturityStaking

BPADMaturityStaking.sol

contracts

Users can stake tokens into the contract `BPADBlockStakeCorePool`. The user can then receive a reward from the contract, but the principal will stay in the contract for one year after the user bets. The `endBlock` that distributes the rewards can be modified by the owner. All rewards can be withdrawn by the owner on an emergency basis.

One point of attention.
- `BPADBlockStakeCorePool` does not provide any emergency withdrawal of tokens for users.

Possible wrong amount

In the contract, `BPADBlockStakePoolFactory`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7c86fd0974eb412797b748bfc4193d97/BPADBlockStakePoolFactory-_owner.svg)

In the contract, `BPADBlockStakePoolFactory`, the role, `isSubAdmin`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `isSubAdmin` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7c86fd0974eb412797b748bfc4193d97/BPADBlockStakePoolFactory-isSubAdmin.svg)

Centralization Risk in BPADBlockStakePoolFactory.sol

The function `changePoolWeight()` will affect the rewards the pool will get. If the pool did not update the `yieldRewardsPerWeight` for a while, the function `chagePoolWeight()` may cause loss to the pool.

Blockius

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

6

0

2

0

4