In the contract `Entry`, the role `admin` has authority over the functions below:

- function quickRegister(), to register for the user.
- function quickAddLocalKey(), to add a local key for the user account.

Any compromise to the `admin` account may allow a hacker to take advantage of this authority and expose users to the threat of property and account risks.

In the contract `Asset`, the role `user` has authority over the following functions:

- function transferETH(), transferToken(), to transfer assets to other accounts.
- function call(), to call any functions of any contracts.

Hackers who have controlled one of the users' keys can withdraw money from their asset contracts.

Centralization Related Risks

In the contract `AssetConfig` the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this authority and bring unpredictable damages to the project.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7ae77801dc82469c94856e631a7963d4/diagrams/centralization-AssetConfig-admin.svg)

In the contract `Entry` the role `timeLockAdmin` has authority over the functions shown in the diagram below.

Any compromise to the `timeLockAdmin` account may allow the hacker to take advantage of this authority and bring unpredictable damages to the project.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7ae77801dc82469c94856e631a7963d4/diagrams/centralization-Entry-timeLockAdmin.svg)

Centralization Risk in Unipass.sol

In the project design, the server plays an important role in the control flow. Emails and admin signatures are generated and used off-chain. The client needs to ensure that the logic is safe and reliable.

Control flow off chain

As mentioned in the notes, allowing users to call arbitrary functions on arbitrary contracts is a security risk.

Owner can call any functions of arbitrary contracts

If one of the user's keys is controlled by untrusted users, he can remove other keys to control the user's assets. The original user cannot freeze the account or reset keys in the recovery process.

Logical issue about keys

The functions directly delete the key at the `delindex` index of `keys` to set it to the default value. However, the length of the keys is not changed.

Logical issue of function delLocalKey

State variables are changed after the transfer or external call, which might leads to a re-entrancy issue.

Check-effects pattern not used

Function dkim_verify is not found in the contract.

Function dkim_verify not found

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

Functions with names starting with `_` should be declared as `private` or `internal`.

Functions With `_` as Name Prefix Are Not `private` or `internal`

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

Comments Should Be in English

The condition `fee > 0` has logical overlaps with the requirement `fee > 0`. If `feeSwitch` is off, the requirement `fee > 0` Can be unfulfilled. If the requirement `fee > 0` is already met, there is no need to check it again.

Logical issue of function transferToken()

UniPass Rangers

unipass.sol

upgrade.sol

Unipass.sol

Upgrade.sol

The `*StartTime` should be less than the `*EndTime`, and the two rounds of pre-sale time and public sale time should have a time sequence requirement.

Lack of Input Validation

The variable `ClaimRecord` is used to keep the claim record and is overwritten after the next claim.
The variable `ClaimWhiteList` is used to keep the number of tokens the user can claim that `setClaimWhiteList` can override.

`ClaimRecord` And  `ClaimWhiteList` Are Overwritten

There is no business logic associated with the variable `PreSaleWhiteList`.

Discussion about `PreSaleWhiteList`

`supply` tokens were sent to the `msg.sender` when deploying the contract. 
This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

When the function `cancelAuctionWhenPaused()` is invoked by the owner, in the function `_cancelAuction()`, NFT should be sent from `address(this)` to `auction.seller`.

Incorrect Transfer Address

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

The contract has an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the considerations of the administrator teamʼs anonymity.

The `owner` of `BoxSale` has the responsibility to notify users about the following capabilities:
- cancel auction when contract paused through `cancelAuctionWhenPaused()`
- withdraw contractʼs ETH/BNB through `withdrawBalance()`
- set `cut` through `setCut()`
- pause the contract through `pause()`
- unpause the contract through `unpause()`
- set `BoxAddresses` through `setBoxAddresses()`
- renounce ownership through `renounceOwnership()`
- transfer ownership through `transferOwnership()`

The `owner` of `LootRangers` has the responsibility to notify users about the following capabilities:
- set `BaseURI` through `changeBaseURI()`
- batch mint the Nft through `batchMint()`
- set `BoxAddresses` through `setBoxAddresses()`
- renounce ownership through `renounceOwnership()`
- transfer ownership through `transferOwnership()`

The `owner` of `LootSale` has the responsibility to notify users about the following capabilities:
- cancel auction when contract paused through `cancelAuctionWhenPaused()`
- withdraw contractʼs ETH/BNB through `withdrawBalance()`
- set `nftAddress` through `setNftAddress()`
- set `cut` through `setCut()`
- pause the contract through `pause()`
- unpause the contract through `unpause()`
- set `BoxAddresses` through `setBoxAddresses()`
- renounce ownership through `renounceOwnership()`
- transfer ownership through `transferOwnership()`

The `owner` of `NftStakingRewards` has the responsibility to notify users about the following capabilities:
- update `powerRewardRate`, `lastUpdateTime` and `periodFinish` through `notifyRewardAmount()` 
- set `nftAddress` through `setNftAddress()`
- set `starttime` through `setStartTime()`
- set `duration` through `setDuration()`
- set `rewardToken` through `setrewardTokenAddress()`
- renounce ownership through `renounceOwnership()`
- transfer ownership through `transferOwnership()`

The `owner` of `BlindBoxCrowdSale` has the responsibility to notify users about the following capabilities:
- set `ClaimWhiteList` through `setClaimWhiteList()` 
- set `PreSaleWhiteList` through `setPreSaleWhiteList()`
- set `BoxAddresses` through `setBoxAddresses()`
- set `PreSale1StartTime` and `PreSale1EndTime` through `PreSale1Start()`
- set `PreSale2StartTime` and `PreSale2EndTime` through `PreSale2Start()`
- set `ClaimStartTime` and `ClaimEndTime` through `ClaimStart()`
- set `PublicSaleStartTime` through `PublicSaleStart()`
- withdraw contractʼs ETH/BNB through `withdrawBalance()`
- withdraw box through `withdrawBox()`
- set `BoxLimit` through `setBoxLimit()`
- renounce ownership through `renounceOwnership()`
- transfer ownership through `transferOwnership()`

Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

`require` can be used to check for conditions and throw an exception if the condition is not met, in which case the descriptive error message provided by the developer will appear and help to track error and debugging.

Lack of Error Message

The linked statements cast a `uint256` value to an `int256` without evaluating its bounds.

Unsafe Casting from `uint256` to `int256`

`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.

Function Visibility Optimization

Unused Imports

In functions `claim()` and `bid()`, the Checks Effects Interaction Pattern has not been strictly followed. the implementation of function `safeTransfer()` is unknown and may have a malicious logical implementation that calls back to the function `claim()`.

Checks Effects Interaction Pattern Not Used

The total number of boxes in contract `BlindBoxCrowdSale`, 7990, is inconsistent with the total number of boxes in contract `LootRangers`, 8000.

in BlindBoxCrowdSale.sol :
```solidity=50
  BoxLimit[0] = 116;
  BoxLimit[1] = 3074;
  BoxLimit[2] = 4800;
```

in LootRangers.sol :
```solidity=46
  boxRange[0] = [1, 126];
  boxRange[1] = [127, 3200];
  boxRange[2] = [3201, 8000];
```

Inconsistent Box Counts

The require statement in the `openBox()` function is to check the range of the number of open boxes, when `num=20` and `start=106`, require returns false and the transaction will be rolled back.

Incorrect Statement In Require

All variable types within Solidity are initialized to their default `empty` value, which is usually their zeroed out representation. 

Particularly:
- `uint` / `int`: All `uint` and `int` variable types are initialized at `0`
- `address`: All `address` types are initialized to `address(0)`
- `byte`: All `byte` types are initialized to their `byte(0)` representation
- `bool`: All `bool` types are initialized to `false`
- `ContractType`: All contract types (i.e. for a given `contract ERC20 {}` its contract type is `ERC20`) are initialized to their zeroed out address (i.e. for a given `contract ERC20 {}` its default value is `ERC20(address(0))`)
- `struct`: All `struct` types are initialized with all their members zeroed out according to this table

Redundant Variable Initialization

The contract is serving as the underlying entity to interact with third-party protocols. The scope of the audit would treat those 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties may be compromised and lead to assets being lost or stolen.

Third Party Dependencies

The function `notifyRewardAmount` is used to update the variables by setting the rewards of the pool. We need to confirm where these tokens are transferred from? Whether the number of tokens in the pool after re-calling the function to set a different reward will meet the system requirements?

Logic Issue In `notifyRewardAmount()`

Loot Rangers

BoxSale.sol

projects

BlindBoxCrowdSale.sol

contracts

LootSale.sol

NftStakingRewards.sol

LootRangers

Box.sol

loot_contract

LootRangers.sol

Centralization Risk

Centralized Background Program

Missing Error Messages

Missing Access Restriction

The Purpose Of Function `speedUp`

Missing A Check For Cross Transfer Fee

What Will Happen If Transfer Fail

Discussion For The Fallback Function

Correct Operation For ERC721 Transfer

Rangers Protocol IV

rangers-protocol-IV

Cross_All.sol

Meaningless State Variables

Unlocked Compiler Version Declaration

Incorrect `uniswapFactory` Address

Incorrect Address

Rangers Protocol III

RPG_ALL_BSC.sol

RPG_ALL_ETH.sol

This report has been prepared for RocketProtocol Foundation Ltd. to discover issues and vulnerabilities in the source code of the Rangers Protocol II project as well as any contract dependencies that were not part of an officially recognized library. A comprehensive examination has been performed, utilizing Static Analysis and Manual Review techniques.

Rangers Protocol

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

13

0

8

0

5