<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `FAFDevVesting`, the role `owner` has authority over the following functions:
- `createVestingSchedule()`
- `createVestingSchedules()`
- `transferOwnership()`
- `_transferBalanceToOwner()`

Any compromise to the `owner` account may allow a hacker to take advantage of this authority and
- create vesting for any unvested account through `createVestingSchedule()`
- create vestings in batches for any unvested accounts through `createVestingSchedules()`
- transfer ownership through `transferOwnership()`
- take any amount of vested tokens on this contract through `_transferBalanceToOwner()`

Centralization Related Risks

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version Declaration

The function that affects the status of sensitive variables should be able to emit events as notifications to users.

Missing Emit Events

Variable `lockTime` could be declared as `constant` since these state variables are never to be changed.

Variable Could Be Declared as `constant`

Mathematical operations in the aforementioned function perform divisions before multiplications. Performing multiplication before division can sometimes avoid loss of precision.

Division Before Multiplication

The owner may take any tokens on this contract. This may create inconsistencies between the actual balance and vesting and affect users' drawdowns.

Owner May Take All Vested Tokens

`start` time needs to be set later than the current timestamp, otherwise, some of the vested tokens cannot be properly claimed by the beneficiary.

Lack of Input Validation

The underlined messages do not align with the function logic and give misinformation.

Leaderboards

Due Diligence Tools

Resources

KYC Status