It is now well understood that the block number or timestamp are not a source of randomness. They can be manipulated if the attacker is also a miner.

Furthermore, regarding the function `generateRandomBatch()` in `RandomBusiness.sol`, even though it suggested that it would generate random values, they are just obtained from the supplied parameters.

Risk For Weak Randomness

Most of the contracts in scope inherited from the `AccessControlUpgradeable` contract, the role `DEFAULT_ADMIN_ROLE` is widely used to protect highly sensitive functions. Therefore, the default admin (contract deployer) has authority over critical functions.

Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority and register new managers or revoke roles on `HexShieldCore`, register calculators on the `LandRarityOracle` smart contract, update parameters for the `Marketplace` contract, register rewards and claims on `MonopolioReward`, update parameters for the `StelarTokenPresale` contract. etc.

Furthermore, the `GAME_ADMIN` could establish a new address for the `hexshield` contract on `StelarTokenPresale.sol` and `MonopolioBusiness.sol` contracts. Similarly, `ORACLE_ROLE` users could set the BNB and token prices at will.

Centralization Related Risks

The given input is missing the check for the non-zero address.

Missing Input Validation

The function that affects the status of sensitive variables should be able to emit events as notifications.

Missing Emit Events

Two pair of contracts were found to be almost identical:
 - `LandRarityOracle.sol` and `LandRarityOracleV2.sol`
 - `WalletOrchestrator.sol` and `WalletOrchestratorV2.sol`

Furthermore, the `Test.sol` and `examples/ExampleRandom.sol` were considered not necessary in the production environment.

Finally, the `HexShield` library does not provide any additional functionality as it only contains a modifier that will not be used.

Duplicate or Redundant Files

Several typos were found in the codebase.

Typos in the contracts

The linked declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. 

Particularly:
- `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers
- `UPPER_CASE`: Should be applied to `constant` variables
- `CapWords`: Should be applied to contract names, struct names, event names and enums

Declaration Naming Convention

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

The error message in `require(balance > 0, "Owner index out of bounds");` does not describe the error correctly.

The second instance of this finding is considered to be ambiguous. Specifically, "Try again" does not provide information about the reason the function call failed. Furthermore, the second and third conditions are already checked by the `minterOnly` modifier, so they are considered unnecessary.

Incorrect Error Message

Boolean constants can be used directly and do not need to be compare true or false.

Boolean Equality

All of the STELAR tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute STELAR tokens without obtaining the consensus of the community.

It was noted that the `StelarTokenPresale` and `StelarTokenDistributor` contracts were developed to perform the token distribution, so the actual risk of this finding would depend on how the whole project is deployed. It was also observed that the HexShield system used by this project would prevent users from selling if certain conditions were not met. According to the Monopolio website: `Only the token can be sold on the Exchange that has circulated at some point through the game and added value in Monopolio`. This system is intended to eliminate speculators and whales.

Initial Token Distribution

The variable `hexShield` assigned in the constructor can declare with `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since will not be stored in storage. Still, values will directly insert the values into the runtime code.

Variable Declare as Immutable

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of a proper ERC-20 implementation.

Unchecked Value of ERC-20 `transfer()`/`transferFrom()` Call

Monopolio

IHexShieldProtected.sol

MonopolioMain.sol

SafeDecimalMath.sol

MonopolioReward.sol

StelarToken.sol

EVRF.sol

libs

LandRarityOracleV2.sol

MonOraclio.sol

StelarTokenPresale.sol

Marketplace.sol

MonopolioLandPresale.sol

HexShield.sol

MonopolioHolders.sol

IHexShield.sol

oracles

HexShieldCore.sol

IMonopolioLand.sol

IRewardPool.sol

StelarTokenDistributor.sol

Test.sol

MonopolioBusiness.sol

IHexShieldCore.sol

LandRarityOracle.sol

IEVRF.sol

MonopolioNFTBase.sol

DateTime.sol

Migrations.sol

IMonOraclio.sol

RandomBusiness.sol

IMonopolioMain.sol

MonopolioLand.sol

ExampleRandom.sol

IRandomBusiness.sol

interfaces

WalletOrchestrator.sol

examples

WalletOrchestratorV2.sol

contracts

IMonopolioBusiness.sol

Monopolio 

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Binance Cuts Ties with WazirX, Cancels Its Wallet Service

TrueFi (TRU) up 64%, Here's Why and What Binance Had to Do With It

Crypto Flipsider News – Binance Adds Apple Pay; Ethereum 2022 Roundup; SOL Falls 97%; Turkey CNBC Test; FBI Probing 3Commas

Binance Coin Price Prediction as BNB Pumps Up 17% in a Week – Time to Buy?

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

Binance Continues Market Dominance with Massive Bitcoin Spot Trading Volume

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

FTX Token price risks 30% plunge as a 23M FTT 'part' moves to Binance - Crypto Capital Today

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Crypto Exchange Binance to Suspend US Dollar Bank Transfers This Week

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

Binance In Hot Water As Documents, Texts On Alleged Plan To Evade Regulations Comes To Light

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

Monopolio

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

7

3

5

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

Partnership

We're Hiring

Disclaimer

Resources

Monopolio

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

7

3

5