In contract `STBU`, the `manager` role have the privilege to mint/burn tokens to/from the `treasury`, whereas the `owner` has the authority to assign/remove `manager` role and set the amount of token each manager can mint/burn. The `owner` also has the privilege to change the `treasury` address and allow/block the interaction with any contract. The related functions are listed below. 

Any comprimise to any of the `manager` account may allow a hacker to take advantage of this authority and mint/burn the allowed amount to/from `treasury`.
Any compromise to the `owner` account may allow a hacker take over the entire contract by arbitrarily changing the `treasury` address, assigning manager role with any allowed amount and eventually minting any amount of token. 

The role `manager` has authority over the following functions:
- `mint()`
- `burn()`


The role `owner` has authority over the following functions:
- `addManager()`
- `removeManager()`
- `addAllowedContract()`
- `removeAllowedContract()`
- `changeTreasury()`
- `receiveStuckTokens()`




Centralization Related Risks

The following functions are declared as `public` and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 

- `addManager()`
- `removeManager()`
- `changeTreasury()`
- `receiveStuckTokens()`
- `mint()`
- `burn()`


Function Visibility Optimization

The function that affects the status of sensitive variables should be able to emit events as notifications to users.
- `addManager()`
- `removeManager()`
- `addAllowedContract()`
- `removeAllowedContract()`
- `changeTreasury()`


Missing Emit Events

State variables `_maxSupply` and `_minSupply` assigned in the constructor can declare with `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since will not be stored in storage. Still, values will directly insert the values into the runtime code.

Stobox Exchange

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

4

0

4

0

0