Read the findings of the 2022 Web3 Security Report

In the contract `bep721.sol` the role `owner` has authority over the following functions:

- `setOwner()`
- `setMinter()`
- `setBaseURI()`
- `setMaxSupply()`
- `setTokenURI()`

In the contract `bep721.sol` the role `minter` has authority over the following functions:

- `mint()`
- `mintMulti()`
- `burn()`

---

In the contract `bep1155.sol` the role `owner` has authority over the following functions:

- `mint()`
- `burn()`

Centralization Related Risks

The function that affects the status of sensitive variables should be able to emit events as notifications.

- `bep20.setOwner()`
- `bep20.setApprovalForAll()`
- `bep721.setOwner()`
- `bep721.setMinter()`
- `bep721.setBaseURI()`
- `bep721.setMaxSupple()`
- `bep721.setTokenURI()`
- `ERC1155.setOwner()`
- `ERC1155._setURI()`

Missing Emit Events

The below list functions are internal and all external calls to these functions are limited. So the modifier `onlyOwner` aforementioned is redundant.

- _setURI()
- _mint()
- _mintBatch()
- _burn
- _burnBatch

Redundant Modifier `onlyOwner`

The 20 billion `MBB` tokens are sent to the specified address `sc` when deploying the contract `MiracleBlindBox`. 

The 3360 million `MU` tokens are sent to the contract deployer when deploying the contract `MiracleUniverse`.

The $10^{32}$ `MG` tokens are sent to the contract deployer when deploying the contract `MiracleGame`.

An `MH` token is sent to the specified address `sc` when deploying the contract. 

This could be a centralization risk as the deployer can distribute `MBB` tokens without obtaining the consensus of the community.

Initial Token Distribution

In the `MiracleBlindBox` contract
```solidity=43
  constructor(IMiracleGameSC sc, address o) Bep1155(o) {
    mint(address(sc), 0, 20000000000, "");
  }
```

In the `Bep1155` contract
```solidity=15
  function mint(
    address to,
    uint256 id,
    uint256 amount,
    bytes memory data
  )
  public
  onlyOwner
```

When deploying, if the parameter `o` is not the address of the caller, the deployment operation will fail due to insufficient permissions. 

Potential Deploy Fail

```solidity=229
  constructor(IMiracleGameSC sc, address o) Bep20(100000000000000000000000000000000, o) {
    transfer(address(sc), 100000000000000000000000000000000);
  }
```

When deploying, if the parameter `o` is not the address of the caller, the deployment will fail due to insufficient `MG` token balance.

```solidity=136
function transfer(address _to, uint _value) public override returns (bool success) {
  require(balances[msg.sender] >= _value, "balances not enough");
  if (balances[msg.sender] >= _value) {
    balances[msg.sender] -= _value;
    balances[_to] += _value;
    emit Transfer(msg.sender, _to, _value);
    return true;
  } else { return false; }
}
```

In the function `transfer()` line 137, the code has checked whether the `msg.sender`'s account balance is sufficient, so the following `if` judgment is redundant.

And there is a similar redundant judgment in the function `transferFrom()`.

Redundant Statements

As this is an error message in contract `Bep20`, it should be `BEP20` or `ERC20` instead of `ERC1155`.

Typo in Error Message

```solidity=1295
function mint(
  address _to,
  uint256 _tokenId
)
  external
  onlyMinter
{
  //require(tokens.length < maxSupply,"Exceeds max supply");
  string memory _uri;
  if(bytes(_uri).length == 0){
    _uri = string(abi.encodePacked(baseURI, _uint2str(_tokenId)));
  } 
  super._mint(_to, _tokenId);
  super._setTokenUri(_tokenId, _uri);
}

function mintMulti(
  address _to,
  uint256 _amount
)
  public
  onlyMinter
{
  //require(tokens.length + _amount < maxSupply,"Exceeds max supply");
  uint256 i = 0;
  uint256 next = tokens.length + 1;
  ......
```

Refer to the function `mintMulti()` the `tokenId` is an auto-incrementing ordinal starting from one. But in the function `mint()`, the `tokenId` is determined by the input parameter. There may be a risk of `tokenId` conflict.

Potential Duplicated tokenId

Miracle Universe

ERC1155.sol

bep20.sol

bep721.sol

Miracle Universe

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

9

0

0