Read the findings of the 2022 Web3 Security Report

```solidity=
    decimalDiff[_edgeToken] = 10**(18 - IERC20MetadataUpgradeable(_edgeToken).decimals());
```
```solidity=
    decimalDiff[token] = 10**(18 - IERC20MetadataUpgradeable(token).decimals());
```
In contracts `TwoWayCenter` and `TwoWayEdge`, according to the formula shown above, the decimal of CenterToken is 18. If decimal of edge token is greater than 18, the above formula will be incorrect. Whether 
all the decimal of edge tokens are less than or equal to 18?

Discussion For The Decimal

The fixed number of nodes, which are centralized programs, control the `crosser` role of `BoringDAO`. If some of the nodes are hacked, then cross-chain exchange may no longer function.

Centralization Background Program

In the contract `TwoWayCenter`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function addToken()
- function onlyAdmin()
- function setStakingRewards()
- function resetStakingReward()
- function setFee()
- function setFeeTo()
- function setTreasuryTo()
- function setWhitelist()
- function setThreshold()

In the contract `TwoWayCenter`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayCenter`, the role `crosser` has authority over the following function:
- function forwardCrossOut()
- function crossIn()
- function issue()

In the contract `TwoWayCenterToken`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayCenterToken`, the role `MINTER_ROLE` has authority over the following function:
- function mint()
`MINTER_ROLE` can mint any tokens to any account.

In the contract `TwoWayCenterToken`, the role `BURNER_ROLE` has authority over the following function:
- function burn()
`BURNER_ROLE` can burn any tokens from any account.

In the contract `TwoWayEdge`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `TwoWayEdge`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function changeSupport()
- function addSupport()
- function setThreshold()

In the contract `TwoWayEdge`, the role `crosser` has authority over the following function:
- function crossIn()

In the contract `TwoWayChef`, the role `DEFAULT_ADMIN_ROLE` has authority over the following function:
- function setDispather()
- function setStakingReward()
- function addPool()
- function setPool()
- function updateRewardPerSecond()

In the contract `TwoWayChef`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `StakingReward`, the role `UPGRADER_ROLE` has authority over the following function:
- function _authorizeUpgrade()

In the contract `StakingReward`, the role `CHEF_ROLE` has authority over the following function:
- function onChefReward()

In the contract `StakingReward`, the role `CENTER_ROLE` has authority over the following function:
- function onChefReward()

Any compromise to the `owner` account may allow a hacker to take advantage of this authority and pose security risks.

Centralization Related Risks

In the contract `StakingReward`, the role `DEFAULT_ADMIN_ROLE` is never used, setup role `DEFAULT_ADMIN_ROLE` should be removed. Instead, setup roles `CHEF_ROLE` and `CENTER_ROLE` should be added.

Missing Setup Role

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

Potential Reentrancy Attack

We think the variable `isInWhilelist` should be `isInWhitelist`. The comment in Line124 should be "remains not match".

Typo In The Contract

According to the code in contract `TwoWayCenter`, `_ratioFeesLow` < `_ratioFeesMedium` < `_ratioFeesHigh`, `remainLow` < `remainHigh`. It's best to add a check in function `setFee`.

Missing A Strict Verification

The given input is missing the check for the non-zero address.

Missing Input Validation

The function that affects the status of sensitive variables should be able to emit events as notifications to users.

Missing Emit Events

BoringDAO V

TwoWayChef.sol

StakingReward.sol

TwoWayProposalVote.sol

TwoWayEdge.sol

TwoWayCenterToken.sol

TwoWayCenter.sol

This report has been prepared for BORTECH LTD. to discover issues and vulnerabilities in the source code of the BoringDAO IV project as well as any contract dependencies that were not part of an officially recognized library. A comprehensive examination has been performed, utilizing Static Analysis and Manual Review techniques.

Unlocked Compiler Version

Centralization Risk

Boolean Equality

Redundant Statements

Variable Declare as Immutable

Unstable Value Of LP Token

Missing Emit Event

Incorrect DataType Of `to`

BoringDAO IV

Proper Usage of "public" And "external" Type

Missing Zero Address Validation

Verify Before Operation

Privileged Ownership

BoringDAO

Boring.sol

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Binance receives green light for crypto services in Dubai

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX's Sam Bankman-Fried Tells Binance CZ "You Won," Here's What Happened

Singapore defends its treatment of Binance after FTX ‘debacle’

Binance proof-of-reserves removed from the auditor's site

Binance Has No Debt And Assets Are Segregated, Report Says

Saudi Crown Prince Mohammed bin Salman Named Prime Minister - WSJ

Luna Classic, Remnant of Terra Collapse, Jumps 60% as Binance Unveils Burn Scheme

Binance CEO met with Abu Dhabi investors about industry recovery fund: Bloomberg

Binance CEO brushes off $2.1 billion FTX clawback concerns

Crypto Exchange Binance Receives License to Operate in Kazakhstan

Binance Dumps FTX, SHIB Burn Rate up 5,800%, U.S. Lawyer Predicts Date of Ripple Case Resolution: Crypto News Digest by U.Today

Binance, OKX Fail to Gain Derivatives Market Share from FTX – Bitget Surges

BoringDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

9

0

0