In the contract `CowBlindBox2` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/46c4a4a4780449eda7bd3280eab11cf1/diagrams/centralization_CowBlindBox2__owner.svg)

Centralization Risks in CowBlindBox2.sol

In the function `open()`, the `cc` token will first be transferred to the contract `CowBlindBox2` to open the blind box. If the call to the function `linkRequest()` fails, or the callback function `fulfillRandomWords()` fails, the `cc` token will not be returned to the user. And in the contract `CowBlindBox2`, there is no function that can restore the `cc` tokens to users.

Logic Issue On Function `open()`

Address should be checked before assignment to make sure it is not zero addresses. 

Missing Zero Address Validation

The variables `_price`, `_minLevel`, and `_maxLevel` do not have reasonable boundaries, so they can be given arbitrary values after deploying.

Lack of reasonable boundary

The `for` loop in the function takes the unbounded variable `num` as the maximum iteration times. If the value of the variable is large, iterating through the entire array could be an expensive operation considering there are external calls in the `for` loop. Even worse, if the computation for each iteration is extremely complex, it could lead to gas insufficiency.


Potential Gas Exhaustion

The contract is serving as the underlying entity to interact with third-party `chainlink`, `MathX128`, `ICowActivity`, and `AdminTransfer` protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The variables `cowAddress`, `cc`, and `link` assigned in the constructor can declare with `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since will not be stored in storage. Still, values will be directly inserted the values into the runtime code.

Variable Declare as Immutable

Users pay the `cc` tokens to open the blind box, and the `cc` tokens are transferred to the contract `CowBlindBox2`, however, there is no implementation to transfer these `cc` tokens elsewhere, such as to the owner. 

No Function to Claim Fees

Cowpark

CowBlindBox2.sol

CowPark

Binance Coin Price Prediction as BNB Pumps Up 17% in a Week – Time to Buy?

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Crypto Exchange Binance to Suspend US Dollar Bank Transfers This Week

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

Singapore defends its treatment of Binance after FTX ‘debacle’

Paxos will no longer issue Binance USD stablecoin

Binance Coin Price Prediction – Can BNB Coin Become the Biggest Crypto?

Saudi Crown Prince Mohammed bin Salman Named Prime Minister - WSJ

Binance CEO met with Abu Dhabi investors about industry recovery fund: Bloomberg

Binance Pool Starts $500 Million Fund to Support Bitcoin Mining

Game On: Buried treasure games of 2022

Mega Matrix discontinues Mano game, alSpace platform due to regulatory issues

Binance says it’s adjusting Tron network withdrawal fees to previous levels

Texts From Crypto Giant Binance Reveal Plan to Elude U.S. Authorities

Binance deploys $1 billion to keep crypto industry afloat after FTX collapse

Expert says the Patriot missiles are 'not a game changer.' Hear why

Flasko (FLSK) Is Expected To Surpass Binance Coin (BNB) And..

Binance Coin (BNB) Price Analysis for January 10

Binance CEO Shares Horrifying Prediction About Major Crypto Crisis

CowPark Token

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

CowPark

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

4

1

6

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

We're Hiring

Disclaimer

Resources

CowPark

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

4

1

6