<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `Old80s`, the role `_owner` has the authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/2c6905ada1e843d8bda702408e0ab3e4/Old80s-_owner.svg)

Centralization Risk

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

In the function `pMint()`, the contract calls the function `onERC721Received()` upon minting an NFT. If the recipient is a contract, a second call can be made to reenter the contract, minting more than the `PUBLIC_LIMIT` in `pMint()` and `MAX_ANDYS` total supply. This would give the caller an unfair advantage in the minting of the NFTs and affecting rarity.

Reentrancy Attack

  Based on the `teamMint()` function, ID numbers in range [MAX_ANDYS - COMMON - CUSTOM, MAX_ANDYS) are reserved for the callee of the function. Should either `saleMint()` or `giveawayTo()` be called to mint in this ID range, the function `teamMint()` would be un-callable.

Missing Reserved ID Check

In the function `fulfillRandomness()`, the condition `(totalTickets <= toRaffleNumber)` and related logic don't require the input of `randomness` provided by the oracle because all tickets are winning. If included in a check prior to calling the oracle, the contract could save on gas and LINK token fees.

Potential Gas Savings

After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring ether as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.

Usage of `transfer()` for Sending Ether

The contract is serving as the underlying entity to interact with third party Chainlink oracle protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The functions `setProvenance()` and `setURI()` require the parameter `elem` to be less than or equal to `2`, however no logic is provided should `2` be provided as an input.

Leaderboards

Due Diligence Tools

Resources

KYC Status