The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

In the contract AccessAdmin.sol, the role `admin` has authority over the functions shown in the diagram below. 
* setAdmin(address _newAdmin)
* doPause()
* doUnpause()

In the contract AccessService.sol, the role `admin` and `service` has authority over the functions shown in the diagram below. 
* setService(address _newService)

In the contract AccessService.sol, the role `admin` and `finance` has authority over the functions shown in the diagram below. 
* setFinance(address _newFinance)

In the contract ActionAuctionHero.sol, the role `admin` has authority over the functions shown in the diagram below. 
* setDataEquip(address _addr)
* setEthAuction(address _addr)
* setDuration(uint64 _duration)

In the contract ActionMiningHero.sol, the role `admin` has authority over the functions shown in the diagram below. 
* setCurrencyContract(address _currencyAddr)
* addWhitelist(address _user, uint256 _quantity)
* setPhase(uint256 _phase)
* setDataMining(address _addr)
* setRecommendStatus(bool _isOpen)
* changeHeroUintPrice(uint256 _unit)

In the contract ActionMiningHero.sol, the role `service` has authority over the functions shown in the diagram below. 
* pushHero(uint256 _orderIndex, IHeroToken.Hero[] memory heros, uint256 _rewardSax)

In the contract ActionStakingHero.sol, the role `admin` has authority over the functions shown in the diagram below. 
* setTokensClaimable(bool _enabled)

In the contract HeroToken.sol, the role `admin` has authority over the functions shown in the diagram below. 
* setActionContract(address _actionAddr, bool _useful)

In the contract HeroToken.sol, the role `actionContract` has authority over the functions shown in the diagram below. 
* safeTransferByContract()
* destroyHero()
* changeHero()

In the contract IdleStoneChef.sol, the role `owner` has authority over the functions shown in the diagram below. 
* add(uint256 _allocPoint, IERC20 _lpToken, bool _withUpdate)
* set(uint256 _pid, uint256 _allocPoint, bool _withUpdate)
* setSaxPerBlock(uint256 _saxPerBlock)

In the contract IdleStoneService.sol, the role `owner` has authority over the functions shown in the diagram below. 
* setActionMiningHero(ActionMiningHero _actionMiningHero)
* setHeroToken(IHeroToken _heroToken)
* pushHero(uint256 _orderIndex, IHeroToken.Hero[] memory heros, uint256 _rewardSax)

In the contract SAXToken.sol, the role `owner` has authority over the functions shown in the diagram below. 
* mint(address _user, uint256 _amount)

In the contract ShellToken.sol, the role `owner` has authority over the functions shown in the diagram below. 
* mint(address _user, uint256 _amount)

Any compromise to the `owner` and `admin` accounts may allow a hacker to take advantage of this authority.

Centralization Related Risks

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

SPDX license identifier not provided in source file. 

SPDX License Identifier Not Provided

`AuctionHeroCreate`, `AuctionHeroCancel`, `AuctionHeroPriceChange` and `AuctionHeroSold` are events, not functions, they lack the `emit` keyword.

Missing `emit` Keyword

The function `_getTokenIdFromBytes` has no concrete implementation and always returns 0. There is no relevant logic.

Function `_getTokenIdFromBytes` Always Returns 0

In the ActionAuctionHero contract, the contract lacks the logic of NFT transfer. The buyer does not obtain the listed NFT after payment, the buyer will suffer a loss.

Contract Lacks Logic Of NFT Transfers

 According to the logic, `phase` represents the type of offering, 1 is pre-sale and 2 is public sale, the public sale checks if the user's quota is sufficient. Our understanding is that whitelist quota is used for pre-sale, and public sale generally does not need whitelist.

Error `phase` Value

The order of external call/transfer and storage manipulation must follow the check-effect-interaction pattern.

Check Effect Interaction Pattern Violated

The state variable `rewardsPerTokenPoints`, `totalUnclaimedRewards`, `pointMultiplier` and `initialised` are never used. 

Unused Variable

According to the logic, if the NFT does not belong to the user, the `totalStakedHeros` should not be decreased.

Using `require` Instead Of `if`

`claimReward()` does not check whether `msg.sender` is the owner of the `tokenId` and the reward is eventually transferred to the `msg.sender`. Since `claimReward()` can be called externally, the reward may be claimed by someone else.

Rewards Can Be Claimed By Others

`DeleteHero` is an event, not a function, it lacks the `emit` keyword.

There are repetitive operation codes in the above lines and these codes are meaningless.

Repeatability Operation Code

According to the logic, The trusted contract has the authority to destroy the NFT, transfer the NFT, and modify the properties of the NFT, but there is no authority verification in the function. Even if the `actionContracts` is controlled by the owner, similar to the whitelist mechanism, the `actionContracts` should also obtain authorization from the owner of the NFT to perform relevant operations on the NFT.

Missing Permission Checks For `actionContracts`

The input parameter `_deleteType` is never used in function `destroyHero()`. 

Unused parameter

The function returns uninitialized dynamic arrays. When setting the value by index for the dynamic array, the array must be initialized first, otherwise an exception will be thrown.

Uninitialized Dynamic Array

There's no sanity check to validate if a pool is existing.

Recommended Explicit Pool Validity Checks

When the same LP token is added into a pool more than once in function `add()`, the total amount of reward in function `updatePool()` will be incorrectly calculated.  The current implementation is relying on the operation correctness to avoid repeatedly adding the same LP token to the pool, as the function will only be called by the owner.

`add()` Function Not Restricted

`BONUS_MULTIPLIER` is set to 1 in the contract and cannot be changed, while `BONUS_MULTIPLIER` is set to 10 in the `SUSHI` finance. `bonusEndBlock` indicates the end of the block with a multiplier, in `SUSHI`, the block before the `bonusEndBlock` gets the `block * BONUS_ MULTIPLIER` reward, i.e. 10 times the reward. But in this contract, since `BONUS_MULTIPLIER` is 1, so `BONUS_MULTIPLIER` and `bonusEndBlock` do not play a similar role, the user stakes NFT to obtain the reward is always 1 times, the two parameters are meaningless, is it in line with the original intention of your design?

Mining Rewards Is Always 1 Times

According to the logic, the owner of the contract can modify the `saxPerBlock`, we recommend calling `massUpdatePools()` before modifying to avoid affecting rewards that have already been created.

Add `massUpdatePools()` In The `setSaxPerBlock` Function

`BONUS_MULTIPLIER` represents a multiple of the reward, but its value is always 1. The `devaddr` address can't do anything in the contract, so we think that they are meaningless.

Meaningless State Variables

State variable initialization error, use `_heroToken` instead of `heroToken`.

Wrong Parameter

It is now well understood that the difficulty or timestamp is not a source of randomness. They can be manipulated if the attacker is also a miner. For EVM compatible blockchains such as Binance smart chain and Polygon, the `block.difficulty`  can be the same value across multiple blocks, making the situation even worse. 

Risk For Weak Randomness

According to the white paper's description of the SAX token:  
"its supply is fixed, so it doesn't grow. And it is consumed and destroyed, so it is an absolutely deflationary token."  
But in the SAXToken contract, there is a `mint` function that can be called by the owner at any time, which means that SAX can be incremented at any time, it is inconsistent with the white paper description.

Logic Is Inconsistent With The White Paper

Idle StoneAge 

AccessService.sol

IdleStoneService.sol

IERC165.sol

IERC721Metadata.sol

IERC721TokenReceiverEx.sol

IERC20.sol

IERC721TokenReceiver.sol

AccessAdmin.sol

ActionAuctionHero.sol

ShellToken.sol

SaxToken.sol

IERC721.sol

Random.sol

ActionStakingHero.sol

interface

IdleStoneChef.sol

IHeroToken.sol

IDataMining.sol

ActionMiningHero.sol

HeroToken.sol

Idle StoneAge

Binance CEO, Coinbase exec feature in Masterclass crypto crash-course

Binance.US Cleared to Buy Voyager Accounts Despite SEC Opposition - WSJ

Bitcoin Price and Ethereum Down 5% amid China Lockdown - Time to Buy?

U.S. made ‘marginal’ gains in internet freedom, report finds

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Ordinals Project Launches Enabling NFTs Directly On Bitcoin

Could Elon Musk Make Twitter A Web3.0 Company?

Binance Cuts Ties with WazirX, Cancels Its Wallet Service

Ethereum (ETH), Algorand (ALGO) Try to Cover Losses; Chronoly.io (CRNO) Increases Gains With Triple Digit Growth | NewsBTC

TrueFi (TRU) up 64%, Here's Why and What Binance Had to Do With It

Paradigm funds auditing DAO Code4rena with $6 million token purchase

Bitcoin Price and Ethereum on the Rise, Maker Price Storms 18%

Bitcoin Price and Ethereum Trade Sideways, Huobi Token Storms 58%

13% of Whole Ethereum (ETH) Supply Staked, But There's Serious Problem with Decentralization

Stacks (STX) surges as Bitcoin NFT hype grows, but its blockchain activity raises concern read full article at worldnews365.me

Terra Founder Do Kwon Reportedly Flees Singapore After Arrest Warrant

Australia Could Soon Regulate Stablecoins and the Digital Yuan - DailyCoin

The most influential CEOs in markets today - MarketWatch

Jake Yocom-Piatt, Co-Founder of Decred, on Blockchain Fixing Political Voting, Campaign Spending and Privacy | Ep. 182

Why Orbeon Protocol (ORBN), Bitcoin (BTC), and Ethereum (ETH) Are Market Leaders | NewsBTC

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

Idle StoneAge

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

25

0

3

0

22

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

Partnership

We're Hiring

Disclaimer

Resources

Idle StoneAge

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

25

0

3

0

22