In the contract `Old80s`, the role `_owner` has the authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2c6905ada1e843d8bda702408e0ab3e4/Old80s-_owner.svg)

Centralization Risk

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

In the function `pMint()`, the contract calls the function `onERC721Received()` upon minting an NFT. If the recipient is a contract, a second call can be made to reenter the contract, minting more than the `PUBLIC_LIMIT` in `pMint()` and `MAX_ANDYS` total supply. This would give the caller an unfair advantage in the minting of the NFTs and affecting rarity.

Reentrancy Attack

  Based on the `teamMint()` function, ID numbers in range [MAX_ANDYS - COMMON - CUSTOM, MAX_ANDYS) are reserved for the callee of the function. Should either `saleMint()` or `giveawayTo()` be called to mint in this ID range, the function `teamMint()` would be un-callable.

Missing Reserved ID Check

In the function `fulfillRandomness()`, the condition `(totalTickets <= toRaffleNumber)` and related logic don't require the input of `randomness` provided by the oracle because all tickets are winning. If included in a check prior to calling the oracle, the contract could save on gas and LINK token fees.

Potential Gas Savings

After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring ether as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.

Usage of `transfer()` for Sending Ether

The contract is serving as the underlying entity to interact with third party Chainlink oracle protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The functions `setProvenance()` and `setURI()` require the parameter `elem` to be less than or equal to `2`, however no logic is provided should `2` be provided as an input.

Old 80's

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

2

1

6