Read the findings of the 2022 Web3 Security Report

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

In the `BSCD.sol` the role `_owner` has authority over the functions:
- mint
- updatePause

In the `BSCD.sol` the role with both `_owner` and `DEFAULT_ADMIN_ROLE` roles has authority over the functions:
- grantContractRole
- revokeContractRole

In the `BSCD.sol` the role `MINTER_ROLE` has authority over the functions:
- claimReward

In the `MSTToken.sol` the role `_owner` has authority over the functions:
- renounceOwnership
- transferOwnership
- setWhitelist
- setWhitelists
- setBlacklists
- setAntiWhale
- setMaxSell
- setMaxBuy
- setAntiWhaleTime
- setLiquidPair
- rescueStuckErc20
- setMinters

In the `MSTToken.sol` the role `minters` has authority over the functions:
- claimReward

Any compromise to these accounts may allow the hacker to take advantage of this authority.

Centralization Related Risks

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Boolean constants can be used directly and do not need to be compared to true or false.
```solidity
        require(blacklist[from] == false, "BLACKLIST");
```



Comparison to Boolean Constant

The return value of the transfer()/transferFrom() call is not checked.
```solidity
        ERC20(_token).transfer(owner(), _amount);
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

The first value of event `SetAntiWhaleTime` should be `_antiWhaleStart` rather than `_antiWhaleEnd`.

Wrong Event

All of the `MST` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `MST` tokens without obtaining the consensus of the community.

Initial Token Distribution

The function `setAntiWhaleTime` is missing the input validation, `antiWhaleStart` should be less than `antiWhaleEnd`. 

Missing Input Validation

The variable `pause` in `MSTToken`, which is used to control minter wether can mint or not, does not have a setter function. This means the `pause` is always false, and the minter always can mint. It is better to add a setter function.

Variable `pause` Without Setter Function

MStation

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

12

0

4

2

6