Read the findings of the 2022 Web3 Security Report

The contract has an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

Literals with many digits are difficult to read and review.

Too Many Digits

The linked variable declarations do not have a visibility specifier explicitly set.

Visibility Specifiers Missing

There are many hardcode addresses in this codebase.

Hardcode Address

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the considerations of the administrator teamʼs anonymity.

The `owner` of `TimelockStake` has the responsibility to notify users about the following capabilities:
- create pool through `createPool()`
- set `poolDepositDisabled` through `setPoolDisabledDeposit()`
- set `poolOffchainId` through `setPoolOffchainId()`
- destroy pool through `destroyPool()`
- force player withdrawals one of stakes through `forcePlayerToWithdraw()`
- force player withdrawals all stakes through `forcePlayerToWithdrawWholePool()`
- withdraw contractʼs tokens through `transferFund()`
- withdraw contractʼs BNB through `transferNetworkCoinFund()`
- erase playerʼs data in pool through `erasePlayerDataInPool()`
- set `owner` through `setOwner()`
- set `chainWrapToken` through `setChainWrapToken()`
- set `swapFactory` through `setSwapFactory()`
- set `swapRouter` through `setSwapRouter()`
- set `usdToken` through `setUSDToken()`


Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

Centralization Related Risks

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

In functions `poolStakeDeposit()`, the Checks Effects Interaction Pattern has not been strictly followed. the implementation of function `transferFrom()` is unknown and may have a malicious logical implementation that calls back to the function `poolStakeDeposit()`.

Checks Effects Interaction Pattern Not Used

When `playerStakeRecordEndTime` is smaller than `block.timestamp`, the code uses `block.timestamp` to calculate the user's reward, and the reward will accumulate the stake expired rewards, As does the code on lines 421 and 528.

Discussion about `forcedEndTime`

The variables `ONE_HUNDRED` and `ONE_YEAR` are unchanged throughout the contract.

Set `constant` to Variables

The contract is serving as the underlying entity to interact with DEX protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, etc.

Third Party Dependencies

The function calls on the aforementioned lines can be substituted with a modifier to increase the legibility of the codebase.

Substitution of `require` Calls With Modifier

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks.

Incompatibility With Deflationary Tokens

The contract contains the functions for transferring tokens from the contract to the user. We need to confirm where these tokens are transferred from? Whether the contract has enough tokens to satisfy the user's reward after the user stake the token.

Lollipop

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

8

0

6