The contract is serving as the underlying entity to interact with third party [Price Oracle] protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

In the contract `Comptroller` the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this.
![](https://accelerator-tasks-prod.s3.amazonaws.com/fdbfb43a6429470e9da3d5c2ecefaeb5/diagrams/centralization-Comptroller-admin.svg)

In the contract `Comptroller` the role `borrowCapGuardian` has authority over the functions shown in the diagram below.

Any compromise to the `borrowCapGuardian` account may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fdbfb43a6429470e9da3d5c2ecefaeb5/diagrams/centralization-Comptroller-borrowCapGuardian.svg)

In the contract `Comptroller` the role `pauseGuardian` has authority over the functions shown in the diagram below.

Any compromise to the `pauseGuardian` account may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fdbfb43a6429470e9da3d5c2ecefaeb5/diagrams/centralization-Comptroller-pauseGuardian.svg)

Centralization Risk in Comptroller.sol

The variables `closeFactorMinMantissa` and `closeFactorMaxMantissa` are never used.

Unused Variable

There should always be events emitted in the sensitive functions that are controlled by centralization roles and are important to users of the protocol.
`setRewardTokenAddress()`

Missing Emit Events

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The audit contains the files `Comptroller.sol` and `MmToken.sol`. The files `Comptroller.sol` and `MmToken.sol` contain many files that are imported. However, the scope of this audit would treat the external dependency entities as black boxes and assume they are logically correct.

External Dependency

In the contract `MmToken` the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fdbfb43a6429470e9da3d5c2ecefaeb5/diagrams/centralization-MmToken-admin.svg)

The `admin` account can directly call the following functions:

- `setPendingAdmin()`
- `_acceptAdmin()`
- `_setComptroller()`
- `_setReserveFactor()`
- `_reduceReserves()`
- `_setInterestRateModel()`
- `_setProtocolSeizeShare()` 

Centralization Risk in MmToken.sol

Mimas Finance

DeFi Protocol Yearn Finance's Token Rises 7% Despite Market Plunge

This DeFi Protocol Just Got Hacked. Its Token Is Still Doing Better than a Major US Bank's

From DeFi to scam awareness, this site arms beginners with the tools they need to thrive in crypto - Cointelegraph

DeFi auditor nets $40,000 for identifying Uniswap vulnerability

DeFi Analyst Predicts $2.00 Per Token For Both Uniglo.io And Ripple In 2023 | NewsBTC

DeFi Exchange Mango's $114M Exploit Was 'Market Manipulation,' Not a Hack, Ex-FBI Special Agent Says

Disney hiring transaction lawyer for ‘aggressive’ NFT and DeFi plans

Crypto Investors Rush To Tonsnipe Presale As Toncoin Enters Top 20 On Coinmarketcap Ahead Of Cronos & Aptos

Gibraltar Will Focus on Stablecoins and DeFi Lending After Market Turmoil

Brett Harrison raises $5 million for DeFi platform aimed at institutions: Bloomberg

Hacker Exploits BNB Chain-Based DeFi Protocol Ankr

BlockTower Capital Crypto Asset Management Firm Loses $1.5M in DeFi Market Aggregator Dexible Exploit: Blockchain Data

DeFi Giant MakerDAO Rejects $100M Stablecoin Loan to State-Chartered Regulated Bank Cogent Bank

Best DeFi Stocks to Stabilise Your Portfolio - Shiba Inu, Avalanche, and Dogetti | NewsBTC

DeFi protocol Archimedes raises $4.9 million in seed funding

Next Level DeFi Concepts From Uniglo.io (GLO) Works In Tandem With Uniswap (UNI) And Bored Ape Yacht Club (BAYC)

A16z Doesn’t Support Plan to Break Up DeFi Giant MakerDAO

USDC Trading Dominates Record Day for DeFi Exchanges Uniswap, Curve

DeFi-Focused Startup Blue Comes Out of Stealth With $3.2M Raise

Coinbase Is Adding DeFi Apps Uniswap and Aave to Its Base Blockchain: Source

Presales Like Uniglo.io (GLO) Are Generating Demand As Ethereum (ETH) Merge Looks To Benefit DeFi And UniSwap (UNI) | NewsBTC

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

Read the findings of the 2022 Web3 Security Report

Mimas Finance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

7

0

7

0

0