Read the findings of the 2022 Web3 Security Report

In the contract `BonusPool`, the role `owner` has authority over the following functions:
- function bindingStake(address _addr, uint256 _deltaEth)
- function unbindStakeAndGetBonus(address _addr, address payable _recipient, uint256 _deltaEth)

In the contract `CommunityPool`, the role `admin` has authority over the following functions:
- function distributeRewards(address payable _to, uint256 _amount)

In the contract `Staking`, the role `admin` has authority over the following functions:
- function removePermission()

In the contract `Staking`, the role `miner` has authority over the following functions:
- function updateActiveValidatorSet(address[] memory newSet)
- function updateRewardsInfo(uint256 _rewardsPerBlock)
- function distributeBlockFee()
- function lazyPunish(address _val)
- function decreaseMissedBlocksCounter()
- function doubleSignPunish(bytes32 _punishHash, address _val)

In the contract `Validator`, the role `owner` has authority over the following functions:
- function addStake(uint256 _stakeGWei)
- function subStake(uint256 _stakeGWei)
- function exitStaking()
- function receiveFee()
- function validatorClaimAny(address payable _recipient)
- function addDelegation(uint256 _stakeGWei, address _delegator)
- function subDelegation(uint256 _stakeGWei, address _delegator)
- function exitDelegation(address _delegator)
- function delegatorClaimAny(address payable _delegator)
- function anyClaimable(uint _unsettledRewards, address _stakeOwner)
- function punish(uint _factor)
- function setState(State s)

In the contract `WithAdmin`, the role `admin` has authority over the following functions:
- function changeAdmin(address newAdmin)

In the contract `WithAdmin`, the role `pendingAdmin` has authority over the following functions:
- function acceptAdmin()

Any compromise to these accounts may allow a hacker to take advantage of this authority.

Centralization Related Risks

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

If validator's manager or delegator is a contract,  and they call function validatorClaimAny/delegatorClaimAny in contract `Staking` to claim tokens, there will be a reentrancy attack. Because when sending tokens in contract `Validator` to validator's manager or delegator, they can re-call function `validatorClaimAny/delegatorClaimAny` through function `fallback()`. The validator's manager or delegator can profit from the reentrant attack because it does not update `valInfos[_val].debt`  after calculating `settledRewards` in Line547.

Potential Reentrancy Attack

The function `initialize()` is `public` and can be called by anyone as long as the contract is deployed.

Lack of Access Control

In the codebase, the statements with the comments **for testcase** do not affect the functionality of the codebase and appear to be either leftover from test code or older functionality.

Redundant Statements

When claiming any tokens through function `validatorClaimAny/delegatorClaimAny`, missing updating validator's debt. So they can profit by calling these functions multip times.

Missing Update Validator's Debt

The given input is missing the check for the non-zero address.

Missing Input Validation

The function that affects the status of sensitive variables should be able to emit events as notifications to customers.
- updateActiveValidatorSet()
- updateRewardsInfo()

Missing Emit Events

According to the code logic, the rewards for validators are transferred into the `Staking` contract when the `initialize()` function modified by `payable` is called. And as the comments say, the `payable` modifier is not used on the `mainnet`. Because the `receive()` function which is used for receiving platform currencies is not defined within the `Staking` contract, there are no rewards for validators.

Unknown Source Of Contract Balance

Cube Chain  

IValidator.sol

SortedList.sol

WithAdmin.sol

initializable.sol

BonusPool.sol

ReentrancyGuard.sol

SafeMath.sol

Validator.sol

Staking.sol

IBonusPool.sol

GenesisLock.sol

types.sol

SafeSend.sol

Params.sol

CommunityPool.sol

Cube Chain 

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

3 reasons why it could be a rocky week for Bitcoin, Ethereum and altcoins

Ethereum price hits $1.6K as markets expect the FED to ease the pressure

Ethereum rallies to $1,350, but derivatives metrics remain neutral to bearish

Bitcoin, Ethereum, Crypto News and Price Data - CoinDesk

How Ethereum based BudBlockz (BLUNT) Unites the Crypto and Marijuana Industries | NewsBTC

FTX.US seems to have paused withdrawals on Ethereum hours after filing for bankruptcy

SHIB Flips SOL by Market Cap, Solana Projects Likely to Move to Ethereum: Crypto Expert

"Ethereum Killer" Solana's Top Spot Threatened by FTX Drama and Emergence of Strong Opponent

Most Hyped Cardano NFT Project Co-Signed by Legendary Ethereum Club

Bitcoin, Ethereum And The FTX Collapse

Ethereum derivatives look bearish, but traders believe the ETH bottom is in

CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data

The New Crypto Project That Swaps Ethereum and BNB for Alternative Investments: HedgeUp

Wormhole Attacker Moves $155 Million of Stolen Funds into Staked Ethereum (stETH)

Ethereum open interest hits $7.7B, raising the chance of a short squeeze above $1.5K

Bitcoin and Ethereum correct as Bitzlato take down, tech layoffs and economic worries dominate headlines

Cube Chain

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

5

0

4