```solidity=
    decimalDiff[_edgeToken] = 10**(18 - IERC20MetadataUpgradeable(_edgeToken).decimals());
```
```solidity=
    decimalDiff[token] = 10**(18 - IERC20MetadataUpgradeable(token).decimals());
```
In contracts `TwoWayCenter` and `TwoWayEdge`, according to the formula shown above, the decimal of CenterToken is 18. If decimal of edge token is greater than 18, the above formula will be incorrect. Whether 
all the decimal of edge tokens are less than or equal to 18?

Discussion For The Decimal

The fixed number of nodes, which are centralized programs, control the `crosser` role of `BoringDAO`. If some of the nodes are hacked, then cross-chain exchange may no longer function.

Centralization Background Program

In the contract `TwoWayCenter`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function addToken()
- function onlyAdmin()
- function setStakingRewards()
- function resetStakingReward()
- function setFee()
- function setFeeTo()
- function setTreasuryTo()
- function setWhitelist()
- function setThreshold()

In the contract `TwoWayCenter`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayCenter`, the role `crosser` has authority over the following function:
- function forwardCrossOut()
- function crossIn()
- function issue()

In the contract `TwoWayCenterToken`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayCenterToken`, the role `MINTER_ROLE` has authority over the following function:
- function mint()
`MINTER_ROLE` can mint any tokens to any account.

In the contract `TwoWayCenterToken`, the role `BURNER_ROLE` has authority over the following function:
- function burn()
`BURNER_ROLE` can burn any tokens from any account.

In the contract `TwoWayEdge`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayEdge`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function changeSupport()
- function addSupport()
- function setThreshold()

In the contract `TwoWayEdge`, the role `crosser` has authority over the following function:
- function crossIn()

In the contract `TwoWayChef`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function setDispather()
- function setStakingReward()
- function addPool()
- function setPool()
- function updateRewardPerSecond()

In the contract `TwoWayChef`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `StakingReward`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `StakingReward`, the role `CHEF_ROLE` has authority over the following function:
- function onChefReward()

In the contract `StakingReward`, the role `CENTER_ROLE` has authority over the following function:
- function onChefReward()

Any compromise to the `owner` account may allow a hacker to take advantage of this authority and pose security risks.

Centralization Related Risks

In the contract `StakingReward`, the role `DEFAULT_ADMIN_ROLE` is never used, setup role `DEFAULT_ADMIN_ROLE` should be removed. Instead, setup roles `CHEF_ROLE` and `CENTER_ROLE` should be added.

Missing Setup Role

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

Potential Reentrancy Attack

We think the variable `isInWhilelist` should be `isInWhitelist`. The comment in Line124 should be "remains not match".

Typo In The Contract

According to the code in contract `TwoWayCenter`, `_ratioFeesLow` < `_ratioFeesMedium` < `_ratioFeesHigh`, `remainLow` < `remainHigh`. It's best to add a check in function `setFee`.

Missing A Strict Verification

The given input is missing the check for the non-zero address.

Missing Input Validation

The function that affects the status of sensitive variables should be able to emit events as notifications to users.

Missing Emit Events

BoringDAO V

TwoWayChef.sol

StakingReward.sol

TwoWayProposalVote.sol

TwoWayEdge.sol

TwoWayCenterToken.sol

TwoWayCenter.sol

This report has been prepared for BORTECH LTD. to discover issues and vulnerabilities in the source code of the BoringDAO IV project as well as any contract dependencies that were not part of an officially recognized library. A comprehensive examination has been performed, utilizing Static Analysis and Manual Review techniques.

BoringDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

9

0

0