<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Short description of the vulnerability and the affected asset.

Vulnerability Title

In the contract `StratPCS`, the role `govAddress` has the authority over the following function:

- `pause()` / `unpause()` 
- `setSettings()` 
- `setOnlyGov()` 
- `setUniRouterAddress()` 
- `setBuyBackAddress()` 
- `setRewardsAddress()` 
- `inCaseTokensGetStuck()` 
- `wrapBNB()` 

Any compromise to the `govAddress` account may allow the hacker to take advantage of this.

Centralization Risk

The endPrice of auction must be not less than the startPrice, itFrom the calculation of the current price of the auction, we can know that the ending price of the auction must not be lower than the starting price. But this kind of verification is currently missing.

Lack of input validation

After the user purchases the blind box, the blind box needs to be opened after the `hashBox` operation. There is a timing problem here. If the hasher never provides the user the `hashBox` operation, then the blind box purchased by the user has no value.

Another important point is that the parameter `_hash` is passed in from outside, which determines the value of the blind box after it is opened,  poses a serious centralization risk.


Discussion for `hashBox()`

The owner of contract `NFTMarket` has the permission to:
- `setOwnerCut` - set `ownerCut` which would be used in `bid()`
- `cancelAuctionWhenPaused`

without obtaining the consensus of the community.

Privileged ownership

The given input is missing the check for the non-zero address.

Missing Input Validation

The owner can call the `setOwnerCut()` function to set the `ownerCut` and there is no upper limit on what the rate can be. In the extreme case, the rate can be as high as 100%, which would imply that the seller cannot get any token.

```solidity=101
function setOwnerCut(uint256 _ownerCut) public onlyOwner {
  require(_ownerCut <= 10000);
  uint oldOwnerCut = ownerCut;
  ownerCut = _ownerCut;
  emit AuctionCutChange(oldOwnerCut, _ownerCut);
}
```

No upper limit for `feeRate`  

```solidity=38
address public constant farmContractAddress =
    0x96423881DDCa161207EE228790524e4fe8E5c9dD;
```

```solidity=44
address public constant earnedAddress =
    0x671ec90dDcC075384E87D6496a1C62C53fA868F4;
```

```solidity=48
address public constant wbnbAddress =
    0x485813Ea110C62CDd6A6a47854E0C4Dd1aC51519;
```

The state variables `farmContractAddress`, `earnedAddress` and `wbnbAddress` come from `Testnet bscscan` chain.

Testnet bscscan address

```solidity=413
function setGov(address _govAddress) public virtual onlyAllowGov {
  govAddress = _govAddress;
  emit SetGov(_govAddress);
}
```

The given input `_govAddress` is missing the check for the non-zero address.

The owner of contract `TinyNFTBlindBoxPresale` has the permission to:
- `collect()` - transfer the tokens of this contract to a certain address
- `setBoxPrice()`, `setBoxStock` - set based information of blindBox
- `hashBox()` - hash box and get `_baseSeed` for opening box.

without obtaining the consensus of the community.

The `public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, external functions are more efficient than `public` functions.

Proper Usage of “public” and “external” type

The linked variables could be declared as `constant` since these state variables are never modified.

Variables that could be declared as `constant`

The owner of contract `TinyNFTLogic` has the permission to:
- `setFarm()`, `setMaxLevel()`, `setAllLevelUpRuleForGrade()`, `setLevelUpRule`.
- `setAllPowerRange()`, `setPowerRange()`

without obtaining the consensus of the community.

Detects the comparison to boolean constants. Boolean constants can be used directly and do not need to be compare to true or false.

Boolean equality

The owner of contract `TinyNFT` has the permission to:
- `mint()`, `mintBatch()` - Minting or batch minting tinyNFT
-  `burn()`, `burnBatch()` - Burning or batch burning tinyNFT
- `updateItemLevel()`, `pause()`, `unpause()`
- `setURI()`

without obtaining the consensus of the community.

The owner of contract `TinyToken` has the permission to:
- `mint()` - mint any amount of tokens to any address.

without obtaining the consensus of the community.

Centralization Related Risks

Tiny World II

TinyNFT

strategies

TinyToken.sol

StratPCS.sol

TinyToken

Leaderboards

Due Diligence Tools

Resources