Read the findings of the 2022 Web3 Security Report

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

### External call(s)
File: ShareNFT.sol (Line 90, Function `ShareNFT.mint1`)
```solidity
        _safeMint(msg.sender, quantity);
```
* This function call executes the following external call(s).
* In `ERC721A._checkOnERC721Received`,
    * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)`

File: ShareNFT.sol (Line 91, Function `ShareNFT.mint1`)
```solidity
        refundIfOver(PRICE * quantity);
```
* This function call executes the following external call(s).
* In `ShareNFT.refundIfOver`,
    * `address(msg.sender).transfer(msg.value - price)`
* This call sends Ether.

### State variables written after the call(s)
File: ShareNFT.sol (Line 93, Function `ShareNFT.mint1`)
```solidity
        _phase1Supply = _phase1Supply.sub(quantity);
```

### External call(s)
File: ShareNFT.sol (Line 102, Function `ShareNFT.mint2`)
```solidity
        _paymentToken.transferFrom(msg.sender, address(this), SECOND_PHASE_PRICE.mul(quantity));
```

File: ShareNFT.sol (Line 104, Function `ShareNFT.mint2`)
```solidity
        _safeMint(msg.sender, quantity);
```
* This function call executes the following external call(s).
* In `ERC721A._checkOnERC721Received`,
    * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)`

### State variables written after the call(s)
File: ShareNFT.sol (Line 106, Function `ShareNFT.mint2`)
```solidity
        _phase2Supply = _phase2Supply.sub(quantity);
```

### External call(s)
File: ShareNFT.sol (Line 76, Function `ShareNFT.mint`)
```solidity
        _safeMint(_to, 1);
```
* This function call executes the following external call(s).
* In `ERC721A._checkOnERC721Received`,
    * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,_data)`
* This call sends Ether.

### State variables written after the call(s)
File: ShareNFT.sol (Line 77, Function `ShareNFT.mint`)
```solidity
        _tokenIdLevel[totalSupply().sub(1)] = _level;
```


Potential Reentrancy Attack

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

In the contract `ShareNFT` the role `_minters` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/13cc577bcdd24b5383a7cb02c93670fc/diagrams/centralization-ShareNFT-_minters.svg)

In the contract `ShareNFT` the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/13cc577bcdd24b5383a7cb02c93670fc/diagrams/centralization-ShareNFT-_owner.svg)

Any compromise to the privileged accounts may allow the hacker to take advantage of this authority and switch owner, withdraw tokens, and modify critical configurations of the contracts.

Centralization Risk in ShareNFT.sol

In contract ShareNFT, there is no erc20 withdraw() function, which means the `_paymentToken` token user paid in below code will be locked in this contract.

```js=97
function mint2(uint256 quantity) external payable {
    require(_phase2Status == Status.Started, "ShareNFT: phase2 no start");
    require(tx.origin == msg.sender, "ShareNFT: Not allow contract");
    require(_phase2Supply.sub(quantity) >= 0, "ShareNFT: Insufficient quantity left");
  
    _paymentToken.transferFrom(msg.sender, address(this), SECOND_PHASE_PRICE.mul(quantity));
```

No ERC20 Withdraw Function

The return value of the transfer()/transferFrom() call is not checked.

File: ShareNFT.sol (Line 102, Function `ShareNFT.mint2`)
```solidity
        _paymentToken.transferFrom(msg.sender, address(this), SECOND_PHASE_PRICE.mul(quantity));
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

Share NFT

ShareNFT.sol

ERC721A.sol

Share NFT Token

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Binance Cuts Ties with WazirX, Cancels Its Wallet Service

Crypto Flipsider News – Binance Adds Apple Pay; Ethereum 2022 Roundup; SOL Falls 97%; Turkey CNBC Test; FBI Probing 3Commas

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

FTX Token price risks 30% plunge as a 23M FTT 'part' moves to Binance - Crypto Capital Today

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Crypto Exchange Binance to Suspend US Dollar Bank Transfers This Week

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

FTX's Sam Bankman-Fried Tells Binance CZ "You Won," Here's What Happened

Binance confirms it's backing out of deal to buy FTX assets - MarketWatch

Singapore defends its treatment of Binance after FTX ‘debacle’

Crypto News Summary: Binance Launches Oracle, UvToken and Team Finance Exploited, Blockchain.com Debuts Visa Card

Share NFT Token

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

6

0

6

0

0