<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `OBIToken` the role `BURNER_ROLE` has authority over the functions shown in the diagram below.
Any compromise to the `BURNER_ROLE` account may allow the hacker to take advantage of this authority and burn all the tokens of any holder without community awareness.
![](https://accelerator-tasks-prod.s3.amazonaws.com/9516d249d00a40baad754f5bb9386c84/diagrams/centralization_OBIToken-OBI-BURNER_ROLE.svg)

In the contract `OBI` the role `MINTER_ROLE` has authority over the functions shown in the diagram below.
Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint an uncontrolled amount of tokens to his EOAs without community awareness.
![](https://accelerator-tasks-prod.s3.amazonaws.com/9516d249d00a40baad754f5bb9386c84/diagrams/centralization_OBIToken-OBI-MINTER_ROLE.svg)


In the contract `OBIToken` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below.
Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and perform, including but not limited to, the following:
- revoke the `BURNER_ROLE` from the intended account.
- revoke the `MINTER_ROLE` from the intended account.
- grant himself (or an account controlled by him) the `BURNER_ROLE` and perform the action described in the `BURNER_ROLE` section.
- grant himself (or an account controlled by him) the `MINTER_ROLE` and perform the action described in the `MINTER_ROLE` section.
![](https://accelerator-tasks-prod.s3.amazonaws.com/9516d249d00a40baad754f5bb9386c84/diagrams/centralization_OBIToken-OBI-DEFAULT_ADMIN_ROLE.svg)


Centralization Risks in OBIToken.sol

All `OBIToken` tokens are sent to the `_vault` EOA when deploying the contract. This is a potential centralization risk as the deployer can distribute `OBIToken` tokens without the consensus of the community.

Initial Token Distribution

In the constructor it is not enforced that `_initialSupply <= cap`. 

Potential `_initialSupply` Over `cap`. 

The variable `cap` is intended to be used as maximum cap of the total supply in the contract and it is set in the constructor. Although, the value of the `cap` is not limited to a maximum value.

Unlimited `cap`   

At the pointed location, the input addresses are not checked to be different than the `address(0)`.

Missing  Input Validation

The linked variable assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The event `CapUpdated` is declared in `OBIToken` but never emitted.

Unused Event

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

Orbofi

OBIToken.sol

CertiK Skynet

Top 10% Security Score

Top 10% Code Security Score

Top 10% Community Score

Top 10% Fundamental Score

Orbofi stands as an AI-driven content layer and platform for creating and distributing AI assets within the realm of web3, games, and the metaverse. By harnessing the power of AI, Orbofi empowers users to swiftly generate game assets and media assets, which can be tokenized on the blockchain. Moreover, it facilitates the monetization of these assets and virtual factories through cryptocurrency.

Leaderboards

Due Diligence Tools

Resources

KYC Status