Read the findings of the 2022 Web3 Security Report

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

Functions below need the `require` check,
- In function `updateMerkleRoot()`: there should be an additional check to guarantee the value of `_merkleRoot` is not equal to bytes32(0).
- In function `createNewClaimTokenContract()`: there should be additional check to guarantee the value of `_merkleRoot` is not equal to bytes32(0) and `_tokenContract` does not equal ZERO address.
- In function `relockGains()`: there should be an additional check to ensure Status is LOCKED.

Missing `require` Statement

Mentioned variables are assigned can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables Can Be Declared as `immutable`

The address should be checked before the assignment to make sure it is not a zero address.

Missing Zero Address Validation

The function that affects the status of sensitive variables should be able to emit events as notifications.

Missing Emit Events

The function `initialize()` should only be callable by the governance account. Otherwise, after the contract deployment, a hacker can be the first to call this function and register malicious contracts, steal funds afterward.

Lack Of Access Restriction On Function `initialize()`

In contract `ClaimToken`, the claim token is only initialized with an uncertain address and the actual implementation is unknown. However, we do not find the code which mints or transfers the claim tokens to the current contract. 

Source Of Claim Token

In the contract `ClaimToken`, the role `Owner` has the authority to arbitrarily update the token claimed amount via the function 'updateAddress()'. Any compromise to the `Owner` account may allow a hacker to take advantage of this authority.



Contract Owner Can Update the Token Claimed Amount

There's no sanity check to validate if the `formerAddress` address is existing in mapping `tokenClaimed`.

Lack of Sanity Check

In the contract `ClaimToken`, the role `Owner` has authority over the following functions:
- function closePoolDistribution(): to deactivate pool distribution.
- function activatePoolDistribution(): to activate pool distribution.
- function updateMerkleRoot(): to update merkle root.
- function updateAddress(): to update `tokenClaimed` of any addresses.
  
Any compromise to the `Owner` account may allow a hacker to take advantage of this authority.

In the contract `ClaimTokenFactory`, the role `Owner` has authority over the following functions:
- function upgradeClaimImplementation(): to upgrade `claimToken` implementation.
- function createNewClaimTokenContract(): to clone a new `claimToken` contract.

Any compromise to the `Owner` account may allow a hacker to take advantage of this authority.

In the contract `GainsLockWallet`, the role `Owner` has authority over the following functions:
- function withdrawGains(): to withdraw gains.
- function relockGains(): to relock gains.

Any compromise to the `Owner` account may allow a hacker to take advantage of this authority.

Centralization Related Risks

The function `createNewClaimTokenContract()` clones a new `ClaimToken` contract and initialize the contract, however, there is no logical implementation to transfer the token claimed records(the mapping `tokenClaimed`) from the original `ClaimToken` contract to the cloned `ClaimToken` contract if there are claim tokens leftover in the original `ClaimToken` Contract.  We would like to confirm with the client if the current implementation aligns with the original project design.

No Function to transfer Token Claimed Records

"The linked `transferFrom()` invocation does not check the return value of the function call which should yield a `true` result in case of proper ERC-20 implementation.

Unchecked Value of ERC-20 `transferFrom()` Call

In the function `createGainsLockedWallet()`, there should be an additional validation to ensure `_subscriptionId` does not exist in the locked wallet pool.

Missing Check in Function `createGainsLockedWallet()`

The variable `_amount` records the amount of token locked, however, the function `withdrawGains()` transfers 'token.balanceOf(address(this))' instead of `_amount` amount of locked tokens to the beneficiary. We would like to confirm with the client if the current implementation aligns with the original project design.


Transfer  `_amount` of  Tokens  To Beneficiary

 GAINS Investment Platform II

ClaimToken.sol

interfaces

GainsLockWallet.sol

ClaimTokenFactory.sol

GainsLockWalletFactory.sol

IGainsLockWallet.sol

IClaimToken.sol

Unlocked compiler version

Off-chain maintained Merkle tree

Lack of view method for the actual contribution

Financial models

Centralization risk

Redundant import files

Lack of restriction on function `finalize()`

Unknown parameter `_proof`

`recover()` only allowed in `CANCELED` state

GAINS Investment Platform

FlashContributionCollector.sol

contributions

ContributionCollectorFactory.sol

IFlashContributionCollector.sol

IPledgeContributionCollector.sol

PledgeContributionCollector.sol

ContributionProxy.sol

IContributionCollectorFactory.sol

GAINS Associates

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Binance Cuts Ties with WazirX, Cancels Its Wallet Service

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX's Sam Bankman-Fried Tells Binance CZ "You Won," Here's What Happened

Binance confirms it's backing out of deal to buy FTX assets - MarketWatch

Singapore defends its treatment of Binance after FTX ‘debacle’

Binance proof-of-reserves removed from the auditor's site

Saudi Crown Prince Mohammed bin Salman Named Prime Minister - WSJ

Luna Classic, Remnant of Terra Collapse, Jumps 60% as Binance Unveils Burn Scheme

Binance CEO met with Abu Dhabi investors about industry recovery fund: Bloomberg

Crypto Exchange Binance Receives License to Operate in Kazakhstan

Binance Dumps FTX, SHIB Burn Rate up 5,800%, U.S. Lawyer Predicts Date of Ripple Case Resolution: Crypto News Digest by U.Today

Binance registers as virtual assets service provider in Poland

GAINS Associates

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

8

1

5