Read the findings of the 2022 Web3 Security Report

In the contract `Permission`, the role `owner` has the authority over the following function:
- function addPermission(address _addPermission)
- function delPermission(address _delPermission)
- function getPermission(uint256 _index)

In the contract `MulAuction`, the role `owner` has the authority over the following function:
- function create(uint startTime, uint maxTime, uint plusTime, uint basePrice, uint addPrice, uint tokenId)
- function stop(uint pid)

In the contract `MulBank`, the role `owner` has the authority over the following function:
- function initPoolList(address[] memory supplyTokens, uint[] memory minAmounts)
- function updateMinDeposit(address[] memory supplyTokens, uint[] memory amounts)
- function switchPool(address[] memory supplyTokens, bool[] memory enable)
- function switchWhiteList(address[] memory users, bool[] memory enable)
- function setUserBalance(address[] memory users, address[][] memory tokens, uint[][] memory amounts)
- function setPeriod(Period _period)

In the contract `MulBank`, the role `permission` has the authority over the following function:
- function pay(address token, uint256 amount, address to)

In the contract `MulERC20`, the role `owner` has the authority over the following function:
- function mint(address _to, uint256 _amount)
- function setDecimal(uint8 decimal)
- function burn(address _to, uint256 _amount)

In the contract `MulWork`, the role `owner` has the authority over the following function:
- function setBaseQuota(address[] memory tokens, uint[] memory amounts)
- function setExtraQuota(address worker, address[] memory tokens, int128[] memory amounts)
- function upgrade(address newContract, uint[] memory tokenIds)

In the contract `MulWork`, the role `permission` has the authority over the following function:
- function settle(address user, address token, int128 profit)

In the contract `Pop721`, the role `owner` has the authority over the following function:
- function mint(address to, uint256 tokenId)

In the contract `Sandbox`, the role `owner` has the authority over the following function:
- function swap(Pool memory pool, uint256 amountSpecified, bool zeroForOne)
- function initialize(Pool memory pool, uint160 sqrtPriceX96)
- function mint(Pool memory pool, int24 tickLower, int24 tickUpper, uint128 amount)
- function burn(Pool memory pool, int24 tickLower, int24 tickUpper, uint128 amount)
- function withdraw(IERC20 token)

In the contract `UniswapV3WorkCenter`, the role `owner` has the authority over the following function:
- function updateDevPercent(uint newPercent)
- function setQuota(address worker, address[] memory tokens, uint[] memory amounts)
- function switchSwap(address[] memory users, bool[] memory enable)
- function switchClaim(address[] memory users, bool[] memory enable)
- function switchPool(address[] memory pools, bool[] memory enable)
- function setWhiteList(address worker, address[] memory pools, bool[] memory enable)
- function updateCommisionPercent(address worker, uint newPercent)
- function setPeriod(uint _period)

In the contract `UniswapV3WorkCenter`, the role `permission` has the authority over the following function:
- function settle(address worker, address poolAddress, address token0, address token1, int128 profit0, int128 profit1)
- function claim(address worker)

In the contract `UniswapV3Strategy`, the role `owner` has the authority over the following function:
- function updateDev(address _devAddr)
- function swapByOwner(SwapParams memory params)
- function divest(uint positionId)
- function add(uint positionId, uint amount0Desired, uint amount1Desired)
- function switching(uint positionId, SwitchParams memory params)
- function collect(uint positionId)

Any compromise to the `owner/permission` account may allow the hacker to take advantage of this.

Centralization Related Risks

There is no validation to check whether the length of `amounts` and the length of `tokens` are the same.

Missing Check for Array's Length

The variable `MAG`is present and initialized but never used. 

Unused Variable

The function `toInt128()`is declared but never used in the contract.


Unused Functions

The function that affects the status of sensitive variables should be able to emit events as notifications to customers.
- `setPeriod()`

Missing Emit Events

There is no validation to check whether the length of `users` and the length of `enable` are the same.

Multiple Ⅱ-2

Sandbox.sol

MulERC20.sol

IWETH9.sol

Pop721.sol

IPayCallback.sol

IUniswapV3Strategy.sol

MulBank.sol

UniswapV3Strategy.sol

ICompoundCETH.sol

base

UniswapV3WorkCenter.sol

MulWork.sol

Permission.sol

IMulBank.sol

IUniswapV3WorkCenter.sol

ICompoundCERC20.sol

MulAuction.sol

interfaces

This report has been prepared for multiple smart contracts, to discover issues and vulnerabilities in the source code of their Smart Contract as well as any contract dependencies that were not part of an officially recognized library. A comprehensive examination has been performed, utilizing Manual Review techniques.

Recommended Explicit Pool Validity Checks

Uninitialized State Variables

Lack of Input Validation

Incorrect `shareToken` amount  in Function `deposit()` and `withdraw()`

Duplicate Code

Privileged Ownership

`GPToken` in Contract `MulWork`

Strengthen Transfer Security

multiple

The best playground for expert traders to provide professional trading AMM liquidity strategies on Uniswap V3.

Multiple

U.S. made ‘marginal’ gains in internet freedom, report finds

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Could Elon Musk Make Twitter A Web3.0 Company?

Australia Could Soon Regulate Stablecoins and the Digital Yuan - DailyCoin

The most influential CEOs in markets today - MarketWatch

S. Korean Authorities Ask Interpol to Issue Red Notice for Terra Co-Founder Do Kwon: Report

Genius Crypto Investments: Oryen (ORY), Solana (SOL), Dogecoin (DOGE) And Fantom (FTM) | NewsBTC

Binance receives green light for crypto services in Dubai

Playboy Returns to The Sandbox, Launches First NFT Collection

NFTs are the key to turning passive fandom into an active community

Neobank Cogni rolls out web3 wallet as fintech firms continue crypto push

XRP (XRP), Avalanche (AVAX), or Snowfall Protocol (SNW)? - Experts Predict A 1000x Increase Coming Soon For The Interoperability Enabling Project

Cardano Price Forecast – Can ADA Make a New All-Time High This Year?

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

ConstitutionDAO2 selling NFTs in fresh bid to buy U.S. Constitution copy

Cardano (ADA) Price Analysis for December 22

OpenSea launches new "on-chain" tool to enforce NFT royalties

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Magic Eden NFT Marketplace Rolls Out Loyalty Program, Native Token in Talks

DeFi needs appropriate regulation before moving to retail, says Fed Chair: Finance Redefined

Multiple

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

6

0

2

0

4