Read the findings of the 2022 Web3 Security Report

All of the USDT and HYRA tokens are sent to the contract owner when deploying the contracts. This could be a centralization risk as the owner can distribute tokens without obtaining the consensus of the community. Any compromise to the owner account may allow the attacker to steal and sell tokens on the market, resulting in severe damage to the project. 

Initial Token Distribution

In the contract `Founder` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and switch owner, and modify critical configurations of the contracts.

![](https://accelerator-tasks-prod.s3.amazonaws.com/d6654c439c064a3b95a0deb930ef8b0f/diagrams/centralization-Founder-_owner.svg)

Centralization Risk in Founder.sol

No token is release to user when function `releaseMyTokenEvent()` and `releaseMyToken()` is called.


No token transferred 

The return value of the transfer()/transferFrom() call is not checked.

File: contracts/Founder.sol (Line 112, Function `Founder.buy`)
```solidity
            sellToken.transfer(msg.sender, _amount);
```


---
File: contracts/Founder.sol (Line 292, Function `Founder.withdrawErc20`)
```solidity
        token.transfer(msg.sender, token.balanceOf(address(this)));
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

### External call(s)
File: contracts/Founder.sol (Line 112, Function `Founder.buy`)
```solidity
            sellToken.transfer(msg.sender, _amount);
```

### State variables written after the call(s)
File: contracts/Founder.sol (Line 113, Function `Founder.buy`)
```solidity
            totalTokenSold += _amount;
```


Potential Reentrancy Attack

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

File: contracts/Founder.sol (Line 288, Function `Founder.withdraw`)
```solidity
       sender.transfer(address(this).balance);
```
- `sender` is not zero-checked before being used.



Missing Zero Address Validation

The functions which are never called internally within the contract should have external visibility for gas optimization.

File: contracts/Founder.sol (Line 165, Contract `Founder`)
```solidity
	function getAvailableAmount(address _lockedAddress) public view returns(uint256 _amount)
```


---
File: contracts/Founder.sol (Line 181, Contract `Founder`)
```solidity
    function getAvailableEventAmount(address _lockedAddress) public view returns(uint256 _amount)
```


---
File: contracts/Founder.sol (Line 196, Contract `Founder`)
```solidity
    function getLockedFullAmount(address _lockedAddress) public view returns(uint256 _amount)
```


---
File: contracts/Founder.sol (Line 208, Contract `Founder`)
```solidity
    function getLockedEventFullAmount(address _lockedAddress) public view returns(uint256 _amount)
```


---
File: contracts/Founder.sol (Line 268, Contract `Founder`)
```solidity
    function releaseAllMyToken() public
```


---
File: contracts/Founder.sol (Line 277, Contract `Founder`)
```solidity
    function releaseAllMyTokenEvent() onTokenGenerationEvent public
```


---
File: contracts/Founder.sol (Line 286, Contract `Founder`)
```solidity
    function withdraw() public onlyOwner {
```


---
File: contracts/Founder.sol (Line 291, Contract `Founder`)
```solidity
    function withdrawErc20(IERC20 token) public onlyOwner {
```


---
File: contracts/Founder.sol (Line 74, Contract `Founder`)
```solidity
    function buy(uint256 _amount) public {
```



Function Should Be Declared External

Accessing storage variables in a loop can be costly in terms of gas consumption.

File: contracts/Founder.sol (Line 224, Function `Founder.transferAndLock`)
```solidity
        totalLockedAmount = totalLockedAmount + _amount;
```



Costly Operation Inside Loop

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The mentioned if-else branch is not completed.

```js==
 79         if(totalTokenSold>totalTokenByRound[0]&&totalTokenSold<=totalTokenByRound[1])
 80         {
 81             currentRound = 1;
 82         }
 83         else if(totalTokenSold>totalTokenByRound[1]&&totalTokenSold<=totalTokenByRound[2])
 84         {
 85             currentRound = 2;
 86         }
 87         else if(totalTokenSold>totalTokenByRound[2]&&totalTokenSold<=totalTokenByRound[3])
 88         {
 89             currentRound = 3;
 90         }
```
And
```js==
 92         if(currentRound>=0 && currentRound<3)
 93         {
                 ...
109         }
110         else if(currentRound == 3)
111         {
112             sellToken.transfer(msg.sender, _amount);
113             totalTokenSold += _amount;
114         }

```

Completion of if-else Branch

Hyperas Chain

Hyperas Chain

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

2

0

9