Read the findings of the 2022 Web3 Security Report

When the farm address is removed from the `MELOSSupplier`, the user cannot retrieve unlocked rewards because the function `updatePool()` may roll back.

Discussion For Function `updatePool()`

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the considerations of the administrator teamʼs anonymity.

The `POOL_SETUP_ROLE` of `MELOSSupplier` has the responsibility to notify users about the following capabilities:
- add a new consumer through `add()`
- remove a consumer through `remove()`
- update the given consumer's MELOS allocation point through `set()`
- set `melosPerBlock` through `setMELOSPerBlock()`

The `PAUSER_ROLE` of `MELOSSupplier` has the responsibility to notify users about the following capabilities:
- pause the contract through `pause()`
- unpause the contract through `unpause()`

The `MINTER_ROLE` of `MinerNFT` has the responsibility to notify users about the following capabilities:
- mint a new token for `to` through `mint()`
- batch mint a new token for `to` through `mintBatch()`



Any compromise to the privileged account may allow a hacker to take advantage of this authority.

Centralization Related Risks

The contract has an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.

Function Visibility Optimization

The variables `lockedPeroid`, `rewardLockedPeroid` and `lpTokenLockedPeroid` are only changed once in the `constructor` function.

Set `immutable` to Variables

`RewardPerBlockUpdated` is missing the keyword `emit`.

Lack of keyword

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

If the parameter  `_startBlock` is greater than `block.number` when the owner adds a consumer through `add()`,  subsequent calls of the function `attribute` or `preview` may cause overflow in the `getMultiplier()` and be rolled back.

Potential Underflow

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

When a token is minted to a user, the mapping `_tokens` is used to record its serial number and owner. However, this record is not updated when the user transfers tokens via `safeTransferFrom` or `safeBatchTransferFrom`, which leads to inconsistencies from the actual token ownership.

Unsound implementation

Lack of Input Validation

The contract `MinerNFT` inherits `ERC1155Burnable` contract, so the tokens of the same id can be minted more than once through function `mint`, yet `_mpowers` only keeps the single latest `_mpower` value, as a result had a token been staked in the `NFTFarming` contract, the corresponding reward may be incorrectly updated when a token with the same id is deposited. The same issue applies to function `mintBatch`.
And when the `burn` function is invoked to delete `_mpowers` it is not verified whether all the tokens of the same id are deleted. `burnBatch` has the same issue.

Discussion For Function `mint()` and `burn()`

The aforementioned does not check if the parameter `values` and `_value` are equal to 1, so when the number of nft transferred to the farm by the user is 0, the user can claim the reward without staking nft.

The function `retrieveLP` does not update the variable `user.lpAmount` when invoked to retrieve the tokens staked in the pool,  so the user can call the function multiple times to retrieve more tokens, so does the function `retrieve`.

`user.lpAmount` Not Update

When standard ERC20 deflationary tokens are transferred, the expended amount may be less than the received amount due to the transaction fee mechanism. As a result of such inconsistency, the depositing transaction will fail the validation checks in `safeTransferFrom()` and be reverted.

Incompatibility With Deflationary Tokens

Melos Studio

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

2

0

13