Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

In the contract `Permission`, the role `owner` has the authority over the following function:
- function addPermission(address _addPermission)
- function delPermission(address _delPermission)
- function getPermission(uint256 _index)

In the contract `MulAuction`, the role `owner` has the authority over the following function:
- function create(uint startTime, uint maxTime, uint plusTime, uint basePrice, uint addPrice, uint tokenId)
- function stop(uint pid)

In the contract `MulBank`, the role `owner` has the authority over the following function:
- function initPoolList(address[] memory supplyTokens, uint[] memory minAmounts)
- function updateMinDeposit(address[] memory supplyTokens, uint[] memory amounts)
- function switchPool(address[] memory supplyTokens, bool[] memory enable)
- function switchWhiteList(address[] memory users, bool[] memory enable)
- function setUserBalance(address[] memory users, address[][] memory tokens, uint[][] memory amounts)
- function setPeriod(Period _period)

In the contract `MulBank`, the role `permission` has the authority over the following function:
- function pay(address token, uint256 amount, address to)

In the contract `MulERC20`, the role `owner` has the authority over the following function:
- function mint(address _to, uint256 _amount)
- function setDecimal(uint8 decimal)
- function burn(address _to, uint256 _amount)

In the contract `MulWork`, the role `owner` has the authority over the following function:
- function setBaseQuota(address[] memory tokens, uint[] memory amounts)
- function setExtraQuota(address worker, address[] memory tokens, int128[] memory amounts)
- function upgrade(address newContract, uint[] memory tokenIds)

In the contract `MulWork`, the role `permission` has the authority over the following function:
- function settle(address user, address token, int128 profit)

In the contract `Pop721`, the role `owner` has the authority over the following function:
- function mint(address to, uint256 tokenId)

In the contract `Sandbox`, the role `owner` has the authority over the following function:
- function swap(Pool memory pool, uint256 amountSpecified, bool zeroForOne)
- function initialize(Pool memory pool, uint160 sqrtPriceX96)
- function mint(Pool memory pool, int24 tickLower, int24 tickUpper, uint128 amount)
- function burn(Pool memory pool, int24 tickLower, int24 tickUpper, uint128 amount)
- function withdraw(IERC20 token)

In the contract `UniswapV3WorkCenter`, the role `owner` has the authority over the following function:
- function updateDevPercent(uint newPercent)
- function setQuota(address worker, address[] memory tokens, uint[] memory amounts)
- function switchSwap(address[] memory users, bool[] memory enable)
- function switchClaim(address[] memory users, bool[] memory enable)
- function switchPool(address[] memory pools, bool[] memory enable)
- function setWhiteList(address worker, address[] memory pools, bool[] memory enable)
- function updateCommisionPercent(address worker, uint newPercent)
- function setPeriod(uint _period)

In the contract `UniswapV3WorkCenter`, the role `permission` has the authority over the following function:
- function settle(address worker, address poolAddress, address token0, address token1, int128 profit0, int128 profit1)
- function claim(address worker)

In the contract `UniswapV3Strategy`, the role `owner` has the authority over the following function:
- function updateDev(address _devAddr)
- function swapByOwner(SwapParams memory params)
- function divest(uint positionId)
- function add(uint positionId, uint amount0Desired, uint amount1Desired)
- function switching(uint positionId, SwitchParams memory params)
- function collect(uint positionId)

Any compromise to the `owner/permission` account may allow the hacker to take advantage of this.

Centralization Related Risks

There is no validation to check whether the length of `amounts` and the length of `tokens` are the same.

Missing Check for Array's Length

The variable `MAG`is present and initialized but never used. 

Unused Variable

The function `toInt128()`is declared but never used in the contract.


Unused Functions

The function that affects the status of sensitive variables should be able to emit events as notifications to customers.
- `setPeriod()`

Missing Emit Events

There is no validation to check whether the length of `users` and the length of `enable` are the same.

Multiple Ⅱ-2

Sandbox.sol

MulERC20.sol

IWETH9.sol

Pop721.sol

IPayCallback.sol

IUniswapV3Strategy.sol

MulBank.sol

UniswapV3Strategy.sol

ICompoundCETH.sol

base

UniswapV3WorkCenter.sol

MulWork.sol

Permission.sol

IMulBank.sol

IUniswapV3WorkCenter.sol

ICompoundCERC20.sol

MulAuction.sol

interfaces

This report has been prepared for multiple smart contracts, to discover issues and vulnerabilities in the source code of their Smart Contract as well as any contract dependencies that were not part of an officially recognized library. A comprehensive examination has been performed, utilizing Manual Review techniques.

Recommended Explicit Pool Validity Checks

Uninitialized State Variables

Lack of Input Validation

Incorrect `shareToken` amount  in Function `deposit()` and `withdraw()`

Duplicate Code

Privileged Ownership

`GPToken` in Contract `MulWork`

Strengthen Transfer Security

multiple

The best playground for expert traders to provide professional trading AMM liquidity strategies on Uniswap V3.

Multiple

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

6

0

2

0

4