<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

The `aHNYReserve` should be compared with the `quantity` of `aHNY` to gain rather the `amount` of `DAI` to be paid.

Wrong `amount` Used For Comparison

When the buyer confirms their purchase and transfer `DAI` onto this contract through `buy()`, `Honey` is not immediately delivered. Rather, the buyer needs to call `redeem()` to receive their `Honey` when `isRedeemLocked` is set true and adequate reserve has been deposited by the owner. If the aforementioned conditions are not met, the buyer's `DAI` will be stranded on this contract.

Purchase Not Immediately Redeemed

In the contract `AHoney`, the state variable `merkleRoot` stands for an off-chain Merkle tree. However, the actual Merkle tree used by the contract is uncertain and can be changed. Normally, the Merkle tree is used to prevent arbitrary change to the nodes, but the contracts allow direct updates to the Merkle tree root, which can change the whole tree. Also, there is no on-chain view method for the users to check whether they are included in the Merkle tree. This may cause confusion among users.

Unknown Merkle tree and parameter `proofs`

The return value of function `transferFrom` are not properly handled.

Return Value Not Handled

In the contract `HoneyDistributionContract` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- set fee allocation addresses and percentages through `setFeeAllocations()`
- set the percent of the sales tax collected that will be sold to the liquidity pool through `setPercentOfFeesToSell()`
- set the router address for the pool that will be selling to through `setUniswapRouter()`
- sets addresses that are able to sell and distribute funds to wallets through `setWhiteListedAddress()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-HoneyDistributionContract-_owner.svg)

In the contract `HoneyDistributionContract` the role `whitelistedAddresses` has authority over the functions shown in the diagram below.

Any compromise to the `whitelistedAddresses` account may allow the hacker to take advantage of this authority and
- sells a set percentage of honey to the liquidity pool for `Matic` through `sellForMatic()`
- claim the fees generated by the sales taxes, and send the honey and `Matic` to the appropriate wallets, in the appropriate ratio through `claimFees()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-HoneyDistributionContract-whitelistedAddresses.svg)

In the contract `Honey` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- set the sales tax through `setSalesTax()`
- set an address to be excluded from the transfer amount restrictions through `ExcludeFromTransferRestrictions()`
- set an address to be excluded from the sales tax through `ExcludeFromTax()`
- set an address to be taxable if tokens are sent to it through `setTaxableRecipient()`
- set how the fees will be allocated when withdrawn through `setFeeAllocations()`
- set the percent of the sales tax collected that will be sold to the liquidity pool for matic through `setPercentOfFeesToSell()`
- claim the fees generated by the sales taxes, and send the honey and matic to the appropriate wallets, in the appropriate ratio `claimFees()`
- set the hexagon marketplace interface, which is used to check royalties collected on the marketplace through `setHexagonMarketplace()`
- add an address that owns a collection traded on the `hexagonMarketplace`, so the address is charged a lower tax percent for the royalties earned through `addWhitelistedCollection()`
- set the distribution contract that will handle the selling and distribution of collected `Honey` through `setDistributionContract()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-Honey-_owner.svg)

In the contract `Honey` the role `taxableRecipient` and `excludedFromTransferRestrictions` has the following privilege
- transfer tokens within the special time period of the first seven days

Any compromise to the `taxableRecipient` and `excludedFromTransferRestrictions` account may allow the hacker to take advantage of this authority.

In the contract `AHoney` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- set the honey token contract address through `SetHoneyAddress()`
- deposit honey into the contract and update reserves through `HNYDeposit()`
- set the Merkle root number that is used to verify if an address is on the whitelist through `updateMerkelRoot()`
- set the lock boolean that determines if `aHNY` can be bought or `Honey` can be redeemed through `setRedeemLock()`
- withdraw `DAI` from the contract through `withdrawDai()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-AHoney-_owner.svg)

In the contract `HexagonMarketplace` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- claims the fees generated by the marketplace, if any, and sends to the proper wallets in the set amounts through `claimFees()`
- add an nft collection to the whitelist, allowing it to be traded on this marketplace, and setting the royalty fee and fee recipient through `addToWhitelist()`
- remove an nft collection to the whitelist, preventing it from being traded on this marketplace through `removeFromWhitelist()`
- update an nft collection's royalty fee and recipient address through `updateWhiteList()`
- add new payment tokens or update previous ones through `setPaymentToken()`
- set how the fees will be allocated when withdrawn through `setFeeAllocations()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-HexagonMarketplace-_owner.svg)

In the contract `HiveReward` the role `CanClaimRewards` has authority over the functions shown in the diagram below.

Any compromise to the `CanClaimRewards` account may allow the hacker to take advantage of this authority and
- take honey tokens on this contract through `ClaimReward()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-HiveReward-CanClaimRewards.svg)

In the contract `HiveReward` and `HiveTreasury`, the role `admin` has authority over the functions shown in the diagram below.

Any compromise to the `admin` account may allow the hacker to take advantage of this authority and
- set an address that is able to claim rewards from this contract through `updateCanClaimRewardsAddress()`
- transfers administration of the contract through `TransferOwnership()`
- add a team member allowing them to vote on/propose transactions through `addTeamMember()`
- remove a team member from being able to vote on/propose transactions through `removeTeamMember()`
- change the number of confirmations required to execute a proposed transaction through `changeNumberConfirmations()`

![](https://accelerator-tasks-prod.s3.amazonaws.com/51434bc739244e9eb5a4b9113bfd2b1a/diagrams/centralization-HiveReward-admin.svg)

In the contract `HiveReward` and `HiveTreasury`, the role `isOwner` has authority over the functions shown below.

Any compromise to the `isOwner` account may allow the hacker to take advantage of this authority and
- propose a transaction that will only execute if the proposal receives enough votes through `submitTransaction()`
- vote that a proposed transaction should execute through `confirmTransaction()`
- vote no on a transaction through `declineTransaction()`



In the contrac `HiveNFT`, the role `_owner` has authority over the functions shown below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- set the percent of the mint cost that will be sold to Matic through `setPercentToSell()`
- set the ability of a contract to transfer these nfts on behalf of the owner through `updateWhitelistedOpperators()`
- change the token generation rate of the nfts through `setEmissionRates()`
- open up the public mint and stop premint through `SetMintingPublic()`
- mint nfts of the specified token-Id, which will be used to airdrop the queens won in the queen auction through `queenMint()`
- mint agreed-upon amount to VC investors while using chainlink to generate a random number and mint the nft through `VCMint()`
- set the ipfs address where the metadata of this collection is stored through `SetBaseURI()`
- claim the mints not sent to the rewards pool, and send the honey and matic to the appropriate wallets by appropriate ratios through `claimFees()`
- set how the fees will be allocated when withdrawn through `setFeeAllocations()`
- change the monthly maintenance fee cost required in order to claim rewards through `setMonthlyTributeFee()`
- set a tax on claiming honey through `setClaimTax()`
- set the liquidity pool to sell honey to through `setLiquidityPool()`
- sets restrictions on calling `transferFrom` through `setRestrictedTrading()`




Centralization Related Risks

The given input is missing the check for the non-zero address.

Missing Input Validation

The contract is serving as the underlying entity to interact with third-party DEX and VRF protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets.

Third Party Dependencies

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

The linked functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 

Function Visibility Optimization

The linked codes do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code

There are several hardcode addresses in this codebase.

Hardcode Address

The reduced tax calculation seems incorrect. The part of the transaction that receives a lower tax should be `royaltiesEarned` minus `tokenSold`, which should be then multiplied by the reduced rate, `collectionOwnersSalesTax`/`BASIS_POINTS`.

Incorrect Calculation Of Tax

All of the `HONEY` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `HONEY` tokens without obtaining the consensus of the community.

Initial Token Distribution

The linked functions alter critical parameters on the contract but there are no reverse methods to reflect changes in collection ownership.

Lack of Reverse Methods

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The white paper specifies a scheme for different minting chances for NFTs tiers that shall have different daily rewards. However, the ratios are not explicitly present in the current `HiveGenesisCollection` contract.

Genesis NFT Ratio Control

For ERC721 tokens, if `listing.quantity` is zero by default or by setting, the buyer may accept the listing and receive the listed token without paying its price. A similar situation exists for bids.

On the other hand, for ERC721 tokens quantity other than one would be the seller over-charging.

Check for `listing.quantity` and `bid.quantity`

When `ERC1155.safeTransferFrom()` is invoked to transfer ERC1155 to a contract, the contract needs to have the corresponding `onReceive()` function implemented, otherwise the transaction may fail. The same applies to ERC721.

Lack of `onReceive()` for ERC1155

The auction should only conclude when the auction is over but the check requires the auction is ongoing.

Incorrect Check

The signature malleability is possible within the Elliptic Curve cryptographic system. An Elliptic Curve is symmetric on the X-axis, meaning two points can exist with the same `X` value. In the `r`, `s` and `v` representation this permits us to carefully adjust `s` to produce a second valid signature for the same `r`, thus breaking the assumption that a signature cannot be replayed in what is known as a replay-attack.

Susceptible to Signature Malleability

The contract includes functions that seem to support buying and selling nfts on listed price but relevant data records are not present in the contract.

Listing And Bidding

The claiming tax is paid from the reward pool while the gains by charity and user are not affected by tax rate.

Claim Tax Paid From RewardPool

An opportunistic user may set up burner accounts call `publicMint()` from different addresses to circumvent this limit.

Over-minting Through Burner Accounts

The old `uniswapV2Router` addresses is still approved unlimited when they are supplanted by a new address.

Approval Not Retracted During Update

The exactly the same code are implemented in function `internalGetTokenEmissionRate()` and `getTokensEmissionRate()`. Likewise, same code are implemented in function `getTokenRewards()` and `calculateReward()`.

Leaderboards

Due Diligence Tools

Resources

KYC Status