Read the findings of the 2022 Web3 Security Report

In contract `NFTBox`, the `operator` has the privilege to mint/burn any token, and change token URLs. The related functions are listed below. Any compromise to the `operator` account may allow a hacker to take advantage of this authority and take over token minting and burning. 
- `mint()`
- `burn()`
- `setBaseTokenURI()`
- `setTokenURI()`

In contract `NFTUnboxing`, the `operator` has the privilege over function `completeUnboxing()`, which. Any compromise to the `operator` account may allow a hacker to take advantage of this authority and take over NFT token minting, and BoxNFT burning.

In addition, both contracts inherit from contract `BaseContract`, which allows the `admin` role to make upgrade, as provided in `UUPSUpgradeable`. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the logic contract address.

Centralization Related Risks in `NFTBox` and `NFTUnboxing`

The `for` loop within functions `_getTotal()` and `_transferBatch()` take `payee.length`, as the maximal iteration times. If the size of the array is large enough, it could exceed the gas limit to execute the functions. In this case, the contract might suffer from DoS (Denial of Service) situation. 

Unbounded Loop

All of the `GameToken` is sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `GameToken` without obtaining the consensus of the community.

Initial Token Distribution

In contract `GameToken`, token transfer can be paused by the `operator` role, and be unpaused by the `admin` role. Any compromise to the `operator` and `admin` account may allow a hacker to take advantage of this authority and disrupt normal token transfer. 

In addition, contract `GameToken` inherits from `BaseContract`, which allows the `admin` role to make upgrade, as provided in `UUPSUpgradeable`. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the logic contract address.

Centralization Related Risks in `GameToken`

The function that affects the status of sensitive variables should be able to emit events as notifications to token holders.

In contract `NFT`:
- `setBaseTokenURI()`
- `setTokenURI()`

In contract `NFTBox`:
- `setBaseTokenURI()`
- `setTokenURI()`

Missing Emit Events

In contract `NFT`, the `operator` has the privilege to mint ERC721 tokens to any account and change the base token URLs. The related functions are listed below. Any compromise to the `operator` account may allow a hacker to take advantage of this authority and take over token minting. 
- `mint()`
- `setBaseTokenURI()`
- `setTokenURI()`

In contract `NFTClaim`, the `operator` has the privilege over function `addMerkleRoot()`, which allows a certain user to mint a specific amount of ERC721 token. Any compromise to the `operator` account may allow a hacker to take advantage of this authority and take over token minting. 

In addition, both contracts inherit from contract `BaseContract`, which allows the `admin` role to make upgrade, as provided in `UUPSUpgradeable`. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the logic contract address.

Centralization Related Risks in `NFT` and `NFTClaim`

The contract is serving as the underlying entity to interact with third party ChainLink `VRFCoordinator` protocols to generate randomness. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts.

Third Party Dependencies

The Harvest Game 

GameToken.sol

INFTBox.sol

NFTStorage.sol

NFT.sol

INFT.sol

NFTBoxStorage.sol

NFTClaim.sol

NFTBox.sol

NFTUnboxingStorage.sol

NFTUnboxing.sol

VRFConsumerBaseV2Upgradeable.sol

The Harvest Game

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Crypto Flipsider News – Binance Adds Apple Pay; Ethereum 2022 Roundup; SOL Falls 97%; Turkey CNBC Test; FBI Probing 3Commas

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

3.7 Trillion SHIB Moved to Exchanges This Week as SHIB Game Soars to Top 20 in App Store

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

FTX Token price risks 30% plunge as a 23M FTT 'part' moves to Binance - Crypto Capital Today

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

FTX's Sam Bankman-Fried Tells Binance CZ "You Won," Here's What Happened

Binance confirms it's backing out of deal to buy FTX assets - MarketWatch

Singapore defends its treatment of Binance after FTX ‘debacle’

Crypto News Summary: Binance Launches Oracle, UvToken and Team Finance Exploited, Blockchain.com Debuts Visa Card

Binance proof-of-reserves removed from the auditor's site

The Harvest Game

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

7

0

5

0

2