Read the findings of the 2022 Web3 Security Report

In the contract `GameCoin`, the role `WHITELISTER_ROLE` has authority over the following functions:
- function addAddressToWhitelist(), to add an address to both `_senderWhitelist` and `_recipientWhitelist`
- function removeAddressFromWhitelist(), to remove an address from both `_senderWhitelist` and `_recipientWhitelist`
- function addAddressToSenderWhitelist(), to add an address to `_senderWhitelist`
- function addAddressToRecipientWhitelist(), to add an address to `_recipientWhitelist`

Any compromise to the `WHITELISTER_ROLE` account may allow a hacker to take advantage of this authority.

In the contract `GameCoin`, the role `PAUSER_ROLE` has authority over the following functions:
- function setBPAddress(), to set a `BotPrevent`
- function setBPEnabled(), to set `bpEnabled`
- function setBotProtectionDisableForever(),to set `BPDisabledForever` true
- function pause(), to pause the transaction
- function unpause(), to unpause the transaction

Any compromise to the `PAUSER_ROLE` account may allow a hacker to take advantage of this authority.


Centralization Related Risks

All of the `initialSupplytokens` amounts of tokens are sent to the `owner` address when deploying the contract `MetaChess`. This could be a centralization risk as the `owner` can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

The variables `treasuryPercent`, `burnPercent` and `stopBurnSupply` do not have reasonable boundaries, so they can be given arbitrary values when deploying.

Lack of reasonable boundary

The function `protect()` is used but not implemented in the audit scope.

Third Party Dependencies

  By making `_treasuryAddress`, `_transferFeeTreasuryPercent`, `_transferFeeBurnPercent` and `_transferStopBurnWhenLowSupply` public could these variables be viewed by the users, hence these view functions are redundant.

Redundant View Functions

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The function that affects the status of sensitive variables should be able to emit events as notifications.

Missing Emit Events

Address should be checked before assignment to make sure it is not zero addresses.

Missing Zero Address Validation

Play Poseidon

Play Poseidon

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

3

1

5