<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Short description of the vulnerability and the affected asset.

Vulnerability Title

The token's decimal is set too small, which could result in much loss in circulation.

Decimals too small

The error message in `require(_isExcluded[account], "Account is already excluded")` does not describe the error correctly.

Incorrect error message

All of the `AOCO` are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `AOCO` tokens without obtaining the consensus of the community.

Initial token distribution

If the allowance is not sufficient to cover the amount of transfer, timely approving allows the transaction to rollback earlier to save gas.

Optimization of function `transferFrom()`

In the contract `AOCO` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add accounts or remove accounts from the reward-excluded list.

![](https://accelerator-tasks-prod.s3.amazonaws.com/69cefa362b8c438aa4a4590c2709a8f3/diagrams/centralization-AOCO-_owner.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change the owner of the contract.

![](https://accelerator-tasks-prod.s3.amazonaws.com/69cefa362b8c438aa4a4590c2709a8f3/diagrams/centralization-Ownable-_owner.svg)

Centralization risk in AOCO.sol

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant code components

The linked variables could be declared as `constant` since these state variables are never modified.

Variables that could be declared as `constant`

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing emit events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper usage of `public` and `external` type

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked compiler version

Mathematical operations in the aforementioned function perform divisions before multiplications. Performing multiplication before division can sometimes avoid loss of precision.

Division before multiplication

The function `totalSupply()` is declared with `pure` identifier, but it reads the state variable `_tTotal`.

Leaderboards

Due Diligence Tools

Resources