Read the findings of the 2022 Web3 Security Report

In the contract `SuperAdmin`, the role `superAdmin` has authority over the following functions:
- changeSuperAdmin()
- pause()
- unpause()

In the contract `GameAdmin`, the role `superAdmin` has authority over the following functions:
- changeGameAdmin()

In the contract `Knot`, the role `superAdmin` has authority over the following functions:
- setUpAllocateContract()

In the contract `KnotAllocate`, the role `superAdmin` has authority over the following functions:
- setUpAllocObjective()
- tge()
- updateOperatorRole()

the role `OPERATOR_ROLE` has authority over the following functions:
- monthRelease()

In the contract `KnotGamePlay`, the role `superAdmin` has authority over the following functions:
- changeCommunityFundAccount()

the role `gameAdmin` has authority over the following functions:
- produce()
- claimRevenue()

In the contract `KnotP2EPool`, the role `superAdmin` has authority over the following functions:
- applyGamePlayBudget()

Any compromise to the these accounts may allow a hacker to take advantage of this authority.

Centralization Related Risks

The economic model of this play-to-earn game project is as follows:

1. The administrator will withdraw the monthly rewards of the game from the KnotP2EPool, for rewarding the player.

2. The player deposits the `knot` tokens into the game as a proof of equity in the game. When depositing, the game server will record the value, and when the player consumes it in the game, the game server will update the player's holding value.

3. The player can withdraw the rewards earned by playing the game, and also withdraw the `knot` tokens that are deposit into the game but not yet consumed. Withdrawing has to be charged fees. Also, player needs the signature of the game server to withdraw.

4. The administrator can withdraw in-game consumption and fees into the consumption pool. The consumption pool has three main purpose: burn, stake, and reward.

Play-To-Earn Model

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Literals with many digits are difficult to read and review.

Too Many Digits

The given input is missing the check for the non-zero address.

Missing Input Validation

The `startTs` could  be less than the `block.timestamp`, we are curious that why do you need the `settleTs` to be set as less than `block.timestamp`? What is the intention of this design?

Discussion for Initialization of `settleTs`

Why does the input parameter `timestamp` can be ten minutes before and after `block.timestamp`? What is the intention of this design?

Discussion for Validation of `timestamp`

Karmaverse

KnotSub.sol

KnotAllocate.sol

base

TxIdempotent.sol

KnotP2EPool.sol

KZKnot.sol

KnotGamePlay.sol

ClaimTimer.sol

knot

GameAdmin.sol

WhiteList.sol

SuperAdmin.sol

access

common

Knot.sol

token

Binance CEO, Coinbase exec feature in Masterclass crypto crash-course

Bitcoin Price and Ethereum Down 5% amid China Lockdown - Time to Buy?

U.S. made ‘marginal’ gains in internet freedom, report finds

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Could Elon Musk Make Twitter A Web3.0 Company?

Ethereum (ETH), Algorand (ALGO) Try to Cover Losses; Chronoly.io (CRNO) Increases Gains With Triple Digit Growth | NewsBTC

Bitcoin Price and Ethereum on the Rise, Maker Price Storms 18%

Bitcoin Price and Ethereum Trade Sideways, Huobi Token Storms 58%

13% of Whole Ethereum (ETH) Supply Staked, But There's Serious Problem with Decentralization

Terra Founder Do Kwon Reportedly Flees Singapore After Arrest Warrant

Australia Could Soon Regulate Stablecoins and the Digital Yuan - DailyCoin

The most influential CEOs in markets today - MarketWatch

Jake Yocom-Piatt, Co-Founder of Decred, on Blockchain Fixing Political Voting, Campaign Spending and Privacy | Ep. 182

Why Orbeon Protocol (ORBN), Bitcoin (BTC), and Ethereum (ETH) Are Market Leaders | NewsBTC

S. Korean Authorities Ask Interpol to Issue Red Notice for Terra Co-Founder Do Kwon: Report

Crypto Flipsider News – Binance Adds Apple Pay; Ethereum 2022 Roundup; SOL Falls 97%; Turkey CNBC Test; FBI Probing 3Commas

ConsenSys intends to store MetaMask user data for only seven days

Genius Crypto Investments: Oryen (ORY), Solana (SOL), Dogecoin (DOGE) And Fantom (FTM) | NewsBTC

Here's How to Lose $15 Million While Being up 11,000 ETH in Profit, NFT Investor Shows

Vitalik Buterin on Ethereum's (ETH) Privacy: 'Stealth Addresses Can Be Implemented Fairly Quickly Today'

Karmaverse

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

4

0

5