Read the findings of the 2022 Web3 Security Report

In the contract `SHO`, the role `owner` has authority over the following functions:
- `whitelistUsers()`: allows the owner to white list users;
- `eliminateUsers1()`: allows the owner to removes all the future allocation of passed user type 1 addresses.

Any compromise to the `owner` account may allow a hacker to take advantage of these functions. 

Centralization Related Risks

According to the code implementation, `whitelistUsers()` adds users and their corresponding allocations that will be distributed in the later stage. Variables `globalTotalAllocation1`/`globalTotalAllocation2` record the total allocation for "option 1"/"option 2", which are used in the fee calculation. 
```solidity=321
uint120 globalAllocation1 = _applyPercentage(globalTotalAllocation1, unlockPercentages[currentUnlock] - lastUnlockPercentage);
uint120 globalAllocation2 = _applyPercentage(globalTotalAllocation2, unlockPercentages[currentUnlock] - lastUnlockPercentage);
```
However, these two variables could be overwritten if `whitelistUsers()` is successfully invoked multiple times. Therefore, it could lead to incorrect fee calculation and the project would suffer unexpected losses.

Exploit Scenario:
- The owner called `whitelistUsers()` to add users A, B and C with "option 1" (each with 1000 allocation). Currently, the total allocation for "option 1" (`globalTotalAllocation1`) is 3000 and the total allocation for "option 2" (`globalTotalAllocation2`) is 0.
- The owner called `whitelistUsers()` again to add user D with "option 2" (each with 1000 allocation). Due to overwriting, the total allocation for "option 1" (`globalTotalAllocation1`) is 0 and the total allocation for "option 2" (`globalTotalAllocation2`) is 1000.
- In this case, the project would lose the fee from "option 1".



`whitelistUsers` Could Overwrite Existing Total Allocation

In general, `external` functions are more efficient than `public` functions.
The `getTotalUnlocksCount` function is never called by the contract and thus could be declared as `external`. 

Improper Usage of `public` and `external` Type

The contract is serving as the underlying entity to interact with the following third-party protocols.
- `shoToken`: tokens to be claimed by users,
- `feeCollector`: address to receive fees,
- `burnValley`: address to "burn" tokens. 

The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts.

For example, as per the project design, the `burnValley` should be a contract without any function. Transferring tokens to `burnValley` contract will forever lock the token. However, if `burnValley` is initialized with an EOA address, it might cause unexpected loss.



Third Party Dependencies

DAO Maker - Vesting

SHO.sol

BurnValley.sol

Division Before Multiplication

Dust Token Amount

Redundant Variable Initialization

Redundant Functionality

Visibility Specifiers Missing

Redundant Conditional

A token vesting implementation that is either sequential or percentage based on periods.

An LP token staking implementation based on LTO Network's implementation

Top 10% Watchlisted

DAO Maker creates growth technologies and funding frameworks for startups, while simultaneously reducing risks for investors. 

Dao Maker 

U.S. made ‘marginal’ gains in internet freedom, report finds

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Ordinals Project Launches Enabling NFTs Directly On Bitcoin

Could Elon Musk Make Twitter A Web3.0 Company?

Terra Founder Do Kwon Reportedly Flees Singapore After Arrest Warrant

Australia Could Soon Regulate Stablecoins and the Digital Yuan - DailyCoin

The most influential CEOs in markets today - MarketWatch

S. Korean Authorities Ask Interpol to Issue Red Notice for Terra Co-Founder Do Kwon: Report

Genius Crypto Investments: Oryen (ORY), Solana (SOL), Dogecoin (DOGE) And Fantom (FTM) | NewsBTC

Binance receives green light for crypto services in Dubai

Playboy Returns to The Sandbox, Launches First NFT Collection

NFTs are the key to turning passive fandom into an active community

Neobank Cogni rolls out web3 wallet as fintech firms continue crypto push

XRP (XRP), Avalanche (AVAX), or Snowfall Protocol (SNW)? - Experts Predict A 1000x Increase Coming Soon For The Interoperability Enabling Project

Cardano Price Forecast – Can ADA Make a New All-Time High This Year?

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

ConstitutionDAO2 selling NFTs in fresh bid to buy U.S. Constitution copy

Cardano (ADA) Price Analysis for December 22

OpenSea launches new "on-chain" tool to enforce NFT royalties

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Dao Maker  Token

Dao Maker

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

4

0

3

0

1