Read the findings of the 2022 Web3 Security Report

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the consideration of the administrator teamʼs anonymity.\
The `DEFAULT_ADMIN_ROLE` of `SKT`, `SMT`, `SPT` and `SUT` has the responsibility to notify users about the following capabilities:
- set `_baseTokenURI` through `setBaseTokenURI()`
  
The `MINTER_ROLE` of `SKT`, `SMT`, `SPT` and `SUT` has the responsibility to notify users about the following capabilities:
- mint nft through `mint()`

The `PAUSER_ROLE` of `SKT`, `SMT`, `SPT` and `SUT` has the responsibility to notify users about the following capabilities:
- pause contract through `pause()`
- unpause contract through `pause()`

Centralization Related Risks

In the contract `KOL_Protect` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/7e1bc6af4d7e4f849d4b0bee4d7c96cb/diagrams/centralization_KOL_Protect__owner.svg)

Centralization Risks in KOLProtect.sol

The aforementioned function has no access control, so anyone can invoke it to transfer `kol` to the contract and receive `1000e18` `usdt`. We would like to know what the purpose of this function is. Also, please note that the decimal of `usdt` on Etherum is 6.

Discussion For Function `app()`

In the contract `SFO_DAO` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/7e1bc6af4d7e4f849d4b0bee4d7c96cb/diagrams/centralization_SFO_DAO__owner.svg)

Centralization Risks in SFO_DAO.sol

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. 

An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit and/or manipulate the token price. 

We find that the `vote()` relies on the price calculation of the number of tokens, meaning that they would be susceptible to flash-loan attacks by manipulating the price of given pairs to the attacker's benefit. 

Potential Flashloan Attack

The aforementioned function lacks access control, so anyone can invoke it and pass in arbitrary input values, which could be harmful to the contract. 

Lack of Access Control

The function `daoAdd()` can be called by anyone to arbitrarily add an unverified token, the methods of which are untrustworthy. This can bring risk whenever these methods are called in the protocol logic.

Token Cannot Be Trusted

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged (and burned) transaction fee. As a result, this may not meet the assumption behind these low-level asset-transferring routines and will bring unexpected balance inconsistencies.

Incompatibility With Deflationary Tokens

There is no check to prevent updating of non-existent `daoAt`.

Lack of Check the Existed `daoAt`

The variable `votes` is an array type and line 254 of the code means that the variable `amounts[i]` is added to the array at the `options[i]` position, and if `options[i]` is greater than the length of the array `votes`, then the function `vote()` will be rolled back, we would like to know more about the function of the variable `votes`.

Discussion about `votes`

The function `voteRecord()` is called to look up the user's vote record. If the passed parameter `count` is less than the number of times the user has voted, then the function will roll back, the function `voteRecordList()` has the same issue.

Potential Failure of Function Call

Starfish OS

KOLProtectV2.sol

SFO_DAO.sol

SKT.sol

SMT.sol

SPT.sol

SUT.sol

Starfish OS 

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Game On: Buried treasure games of 2022

Mega Matrix discontinues Mano game, alSpace platform due to regulatory issues

Hasbro Is 'Killing its Golden Goose' Card Game. BofA Downgrades To Sell.

Expert says the Patriot missiles are 'not a game changer.' Hear why

Crypto’s Game Plan After FTX’s Collapse

After Logan Paul's CryptoZoo game failed to let players

Robocallers have upped their scam game and they’re after your crypto

Shiba Eternity Game: Australia Might Be "Last Test Location," Says SHIB Lead Dev

MetaMask Launches Bridge Aggregator to Move Tokens Across Blockchains – Game Changer?

Rally in Crypto Game Axie's AXS Token Faces Skepticism From Derivative Traders

BC.GAME is Hosting A Huge Lottery Event to Celebrate Argentina's Historic Win

Why crypto fraud is a game of whack-a-mole

first game from Shrike Tabletop is a tactical, ANTIFA-pu

Gala Games Buys Walking Dead Empires Game Studio, Token Surges 17%

Shiba Eternity Game Devs Now Accept Ideas from Users: Details

This CEO Claims SHIB Is Pyramid Scheme, John Deaton Shares Why SEC Is Wrong About XRP Status, Shiba Eternity Game Gets Upgrade: Crypto News Digest by U.Today

Starfish OS

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

10

0

1