Read the findings of the 2022 Web3 Security Report

1. In the function `depositToken()`, the protocol does not record the deposit information and the user cannot receive any interest. Does this meet the design intent? How can the team protect the users' assets?

```solidity
bool valid = MerkleProof.verify(merkleProof, merkleRoot, leaf).
```

2. In the function `claimTokens()`, the validation certificate `merkleProof` comes from the caller's parameter, which depends on an external system. What is this external system? We suggest that the team should be transparent to the community about this system.

Discussions about `PandaClaim.sol`

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

Every cycle, the owner should first set up a new `merkleRoot` and then investors can claim tokens from this protocol. How can users who missed the previous cycle claim their tokens?

Potential Missing Claim Token

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

User-Defined Getters

Functions with names starting with `_` should be declared as `private`/`internal`.

Functions With `_` as Name Prefix Are Not `private` or `internal`

In the contract `Tickets` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3acfca9111c446c1b074e56baade0aff/diagrams/centralization_Tickets__owner.svg)

---

In the contract `PandaClaim` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw all of the assets from this protocol.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3acfca9111c446c1b074e56baade0aff/diagrams/centralization_PandaClaim__owner.svg)

---

In the contract `AccessControl` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3acfca9111c446c1b074e56baade0aff/diagrams/centralization_AccessControl__owner.svg)

---

In the contract `SmartWalletChecker` the role `isManager` has authority over the functions shown in the diagram below.

Any compromise to the `isManager` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3acfca9111c446c1b074e56baade0aff/diagrams/centralization_SmartWalletChecker_isManager.svg)

---

In the contract `VeToken` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3acfca9111c446c1b074e56baade0aff/diagrams/centralization_VeToken__owner.svg)

Centralization Related Risks

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as Constant

If the owner sets `clearBlk` and the block count is reached, the pool `accScorePerToken` is emptied and recalculated, and the user's previously accumulated score is emptied and recalculated. Is this score a reward? Does this cause users to lose their scores? Is this consistent with the design intent?

Disscussion about `VeToken.sol`

PandaDAO

AccessControl.sol

Tickets.sol

VeTokenStorage.sol

PandaDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

0

1

8