Read the findings of the 2022 Web3 Security Report

```solidity=1687
function create(
  string calldata _metaDataURI,
  string calldata _metaData
)
  external
{
  _create(msg.sender, _metaDataURI, _metaData);
}
```

The function `NFTToken.create()` is used to create an NFT token for the caller, without any restrictions. Anyone can call this function on their own. This does not make sense.

No Access Control

In the contract `ERC721` the role `owner` has authority over the functions shown in the diagram below.

Any compromise to the `owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_ERC721_owner.svg)

In the contract `GenerativeNFT` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_GenerativeNFT__owner.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_Ownable__owner.svg)

Centralization Risks in generativeNFT.sol

It is highly recommended NOT to include OpenZeppelin library code directly in source code, but import the original library to minimize risk because even slight changes to the library code may lead to critical/major vulnerabilities/bugs. For Solidity version 0.6.x, the latest OpenZeppelin version 3.4.2 should be used. 

OpenZeppelin library code included in source code

The functions which are never called internally within the contract should have external visibility for gas optimization.


File: projects/OmniHorse/NFTToken.sol (Line 77, Contract `Ownable`)
```solidity
    function renounceOwnership() public virtual onlyOwner {
```

---
File: projects/OmniHorse/NFTToken.sol (Line 86, Contract `Ownable`)
```solidity
    function transferOwnership(address newOwner) public virtual onlyOwner {
```

---
File: projects/OmniHorse/generativeNFT.sol (Line 1835, Contract `Ownable`)
```solidity
    function renounceOwnership() public virtual onlyOwner {
```


---
File: projects/OmniHorse/generativeNFT.sol (Line 1844, Contract `Ownable`)
```solidity
    function transferOwnership(address newOwner) public virtual onlyOwner {
```


---
File: projects/OmniHorse/generativeNFT.sol (Line 1877, Contract `GenerativeNFT`)
```solidity
    function reserveNFT(uint256 numberOfNfts, address[] memory _senderAddress) public onlyOwner {
```


---
File: projects/OmniHorse/generativeNFT.sol (Line 1888, Contract `GenerativeNFT`)
```solidity
    function setBaseURI(string memory baseURI) public onlyOwner {
```


---
File: projects/OmniHorse/generativeNFT.sol (Line 290, Contract `ERC165`)
```solidity
    function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
```



Declaration Naming Convention

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

Multiple Solidity versions are used in the codebase.

Versions used: `>=0.6.0<0.8.0`, `>=0.6.2<0.8.0`, `^0.7.0`


File: projects/OmniHorse/generativeNFT.sol (Line 1785)
```solidity
pragma solidity >=0.6.0 <0.8.0;
```

File: projects/OmniHorse/generativeNFT.sol (Line 528)
```solidity
pragma solidity >=0.6.2 <0.8.0;
```

File: projects/OmniHorse/generativeNFT.sol (Line 1853)
```solidity
pragma solidity ^0.7.0;
```


---
Versions used: `>=0.6.2<0.8.0`, `>=0.6.0<0.8.0`, `^0.6.8`


File: projects/OmniHorse/PayableTokenMarketplace.sol (Line 1054)
```solidity
pragma solidity ^0.6.8;
```

File: projects/OmniHorse/PayableTokenMarketplace.sol (Line 682)
```solidity
pragma solidity >=0.6.2 <0.8.0;
```

File: projects/OmniHorse/PayableTokenMarketplace.sol (Line 971)
```solidity
pragma solidity >=0.6.0 <0.8.0;
```



Different Solidity Versions

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

In the contract `FeeManager` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_FeeManager__owner.svg)

In the contract `PayableTokenMarketplace` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_PayableTokenMarketplace__owner.svg)

In the contract `PayableTokenMarketplace` the role `assetOwner` has authority over the functions shown in the diagram below.

Any compromise to the `assetOwner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/fbb0145f7df0451cad9258f7990c977b/diagrams/centralization_PayableTokenMarketplace_assetOwner.svg)

Centralization Risks in PayableTokenMarketplace.sol

In the current design, if the user successfully creates a `bid` (price higher than the previous `bid`), it will override the previous bid. When canceling the `bid`, the `bid` record (`bidByOrderId[_nftAddress][_assetId]`) will be deleted. 

If a malicious user keeps creating the highest bid and canceling it to delete the `bid` record, it may cause the bid record to remain NULL. In this case, the bid might never be successfully settled.

We hope to check with the team about the design and ensure this would not cause any problems for the protocol.


Potential Bid Failure Caused by Bid Cancellation

The input parameter `_expiresAt` lacks a check for later than `block.timestamp`.

Missing Input Validation

The state variable `MARKETPLACE_ETHER` has been declared as `0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE`, but it is not used in function `_createBid()`.

OmniHorse

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

12

0

3

0

9