Read the findings of the 2022 Web3 Security Report

`totalSupply_` tokens were sent to the `msg.sender` when deploying the contract. 
This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the consideration of the administrator teamʼs anonymity.

The `owner` of `MetahubCoin` has the responsibility to notify users about the following capabilities:
- set `DefaultLockRule` through `setDefaultLockRule()`
- set `startLockTime` through `setStartLockTime()`
- set `LockRule` of account through `setAccountLockRule()`
- freeze account through `freeze()`
- unfreeze account through `unfreeze()`
- set `lockContract` through `setLockContract()`
- set `keepBalance` through `setKeepBalance()`
- set `lqWallet` through `setLqWallet()`
- set `feeWallet` through `setFeeWallet()`
- set `sellFeeRate` and `buyFeeRate` through `setFeeRate()`
- set `sellBurnFeeRate` and `buyBurnFeeRate` through `setBurnFeeRate()`
- set `sellLqFeeRate` and `buyLqFeeRate` through `setLqFeeRate()`
- add pair address through `setSwapPair()`
- set `sellFeeWhiteList` or `buyFeeWhiteList` through `setFeeWhiteList()`

Centralization Related Risks

The variable `speedLockAmount[recipient]` should be equal to the `balanceOf(recipient)` minus the amount locked by the recipient's ILock contract, not the sender's.

Incorrect Calculation Of `speedLockAmount[recipient]`

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

The contract is serving as the underlying entity to interact with third-party protocols. The scope of the audit would treat those 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties may be compromised and lead to assets being lost or stolen.

Third Party Dependencies

The function `setLqWallet` and `setFeeWallet` mainly update the new address, without revoking the authorization of the old address.

Privilege Revoke

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

The `require` can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The linked variables could be declared as `constant` since these state variables are never modified.

Set `constant` to Variables

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Set `immutable` to Variables

The functions `burn` and `burnFrom` do not check if the balance of the account after destruction is greater than the `lockAmount` obtained from the `lockContract` contract.

Discussion For Function `burn()` and `burnFrom()`

Metahub Coin

IUniswapV2Factory.sol

IUniswapV2Router.sol

Metahub

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

6

1

4