THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings
to show all the results. Summary
- arbitrary-send-eth (1 results) (High)
- reentrancy-eth (3 results) (High)
- reentrancy-no-eth (2 results) (Medium)
- uninitialized-local (1 results) (Medium)
- unused-return (17 results) (Medium)
- events-access (1 results) (Low)
- missing-zero-check (2 results) (Low)
- reentrancy-benign (6 results) (Low)
- reentrancy-events (12 results) (Low)
- timestamp (9 results) (Low)
- assembly (3 results) (Informational)
- dead-code (1 results) (Informational)
- low-level-calls (4 results) (Informational)
- naming-convention (3 results) (Informational)
- reentrancy-unlimited-gas (14 results) (Informational)
- unused-state (1 results) (Informational)
arbitrary-send-eth
Impact: High Confidence: Medium
- ID-0 HoldEarn._transferOut(address,address,uint256) sends eth to arbitrary user Dangerous calls:
Sample.sol#L2014-L2022
reentrancy-eth
Impact: High Confidence: Medium
-
ID-1 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- userBet[msg.sender][pID].sTid.push(tID) HoldEarn.userBet can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn.checkClaim(address,uint256)
- HoldEarn.dealArray(uint256,uint256,address[])
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getUser(uint256,uint256)
- HoldEarn.getUserBet(address,uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.withdrawAll(uint256)
- userReward[msg.sender][pID][tID].claimSort = sReward HoldEarn.userReward can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn.userReward
Sample.sol#L1669-L1708
-
ID-2 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- _transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- j < rewardID[pID].length() HoldEarn.userBet can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn.checkClaim(address,uint256)
- HoldEarn.dealArray(uint256,uint256,address[])
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getUser(uint256,uint256)
- HoldEarn.getUserBet(address,uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.withdrawAll(uint256)
- userBet[msg.sender][pID].bTid.push(tID_scope_0) HoldEarn.userBet can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn.checkClaim(address,uint256)
- HoldEarn.dealArray(uint256,uint256,address[])
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getUser(uint256,uint256)
- HoldEarn.getUserBet(address,uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.withdrawAll(uint256)
- userReward[msg.sender][pID][tID_scope_0].claimBase = bReward HoldEarn.userReward can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn.userReward
Sample.sol#L1669-L1708
-
ID-3 Reentrancy in HoldEarn.setDefaultToken(uint256,address,uint256): External calls:
- _transferOut(msg.sender,periodInfo[pID].defaultToken,beforeAmount)
- _transferIn(msg.sender,token,afterAmount)
- _transferOut(msg.sender,periodInfo[pID].defaultToken,beforeAmount)
-
_transferIn(msg.sender,token,afterAmount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- periodInfo[pID].defaultToken = token HoldEarn.periodInfo can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn._periodPrize(uint256,bool)
- HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[])
- HoldEarn.check(address,uint256)
- HoldEarn.checkAdd(address,uint256,HoldEarn.RewardTokenInfo)
- HoldEarn.checkBase(address,uint256)
- HoldEarn.checkDefault(address,address,uint256,uint256)
- HoldEarn.checkDeposit(address,uint256,uint256)
- HoldEarn.checkSetMinNum(address,uint256,uint256)
- HoldEarn.checkSetRewardToken(address,address,uint256,uint256,uint256,uint256)
- HoldEarn.checkWithdraw(address,uint256)
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getPoolInfo(uint256)
- HoldEarn.getStatus(uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.notStart(uint256)
- HoldEarn.setDefaultToken(uint256,address,uint256)
- HoldEarn.setLockTime(uint256,uint256)
- HoldEarn.setMinNum(uint256,uint256)
- HoldEarn.setName(uint256,string)
- HoldEarn.setPeriodTime(uint256,uint256)
- HoldEarn.setUserNum(uint256,uint256,uint256)
- HoldEarn.setUserToken(address,uint256,uint256)
- HoldEarn.update(uint256)
- HoldEarn.withdrawAll(uint256)
- periodInfo[pID].perDefaultAmount = perAmount HoldEarn.periodInfo can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn._periodPrize(uint256,bool)
- HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[])
- HoldEarn.check(address,uint256)
- HoldEarn.checkAdd(address,uint256,HoldEarn.RewardTokenInfo)
- HoldEarn.checkBase(address,uint256)
- HoldEarn.checkDefault(address,address,uint256,uint256)
- HoldEarn.checkDeposit(address,uint256,uint256)
- HoldEarn.checkSetMinNum(address,uint256,uint256)
- HoldEarn.checkSetRewardToken(address,address,uint256,uint256,uint256,uint256)
- HoldEarn.checkWithdraw(address,uint256)
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getPoolInfo(uint256)
- HoldEarn.getStatus(uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.notStart(uint256)
- HoldEarn.setDefaultToken(uint256,address,uint256)
- HoldEarn.setLockTime(uint256,uint256)
- HoldEarn.setMinNum(uint256,uint256)
- HoldEarn.setName(uint256,string)
- HoldEarn.setPeriodTime(uint256,uint256)
- HoldEarn.setUserNum(uint256,uint256,uint256)
- HoldEarn.setUserToken(address,uint256,uint256)
- HoldEarn.update(uint256)
- HoldEarn.withdrawAll(uint256)
- periodState[pID].totalDefaultAmount = afterAmount HoldEarn.periodState can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn._periodPrize(uint256,bool)
- HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[])
- HoldEarn.checkClaim(address,uint256)
- HoldEarn.checkDefault(address,address,uint256,uint256)
- HoldEarn.checkDeposit(address,uint256,uint256)
- HoldEarn.checkSetMinNum(address,uint256,uint256)
- HoldEarn.checkSort(address,uint256,uint256,address[])
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getStatus(uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.periodState
- HoldEarn.setDefaultToken(uint256,address,uint256)
- HoldEarn.sortAccounts(uint256,uint256,address[])
- HoldEarn.update(uint256)
Sample.sol#L1392-L1406
reentrancy-no-eth
Impact: Medium Confidence: Medium
-
ID-4 Reentrancy in HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]): External calls:
- IERC20(rInfo[i].rewardToken).safeTransferFrom(msg.sender,address(this),rInfo[i].totalAmount) State variables written after the call(s):
- tID = ++ tokenInfoID[periodID] HoldEarn.tokenInfoID can be used in cross function reentrancies:
- HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[])
- HoldEarn.addToken(uint256,HoldEarn.RewardTokenInfo)
- HoldEarn.tokenInfoID
Sample.sol#L1409-L1440
-
ID-5 Reentrancy in HoldEarn.deposit(uint256,uint256): External calls:
- IERC20(periodInfo[pID].userToken).safeTransferFrom(msg.sender,address(this),amount) State variables written after the call(s):
- periodState[pID].totalAmount = periodState[pID].totalAmount.add(amount) HoldEarn.periodState can be used in cross function reentrancies:
- HoldEarn._getReward(uint256)
- HoldEarn._periodPrize(uint256,bool)
- HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[])
- HoldEarn.checkClaim(address,uint256)
- HoldEarn.checkDefault(address,address,uint256,uint256)
- HoldEarn.checkDeposit(address,uint256,uint256)
- HoldEarn.checkSetMinNum(address,uint256,uint256)
- HoldEarn.checkSort(address,uint256,uint256,address[])
- HoldEarn.deposit(uint256,uint256)
- HoldEarn.getStatus(uint256)
- HoldEarn.getUserReward(address,uint256,uint256)
- HoldEarn.periodState
- HoldEarn.setDefaultToken(uint256,address,uint256)
- HoldEarn.sortAccounts(uint256,uint256,address[])
- HoldEarn.update(uint256)
Sample.sol#L1456-L1475
uninitialized-local
Impact: Medium Confidence: Medium
- ID-6 HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256).tType is a local variable never initialized
Sample.sol#L1357
unused-return
Impact: Medium Confidence: Medium
- ID-7 HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256) ignores return value by rewardID[pID].add(tID)
Sample.sol#L1321-L1368
- ID-8 HoldEarn.removeToken(uint256,uint256) ignores return value by rewardID[pID].remove(tID)
Sample.sol#L1302-L1319
- ID-9 HoldEarn.addToken(uint256,HoldEarn.RewardTokenInfo) ignores return value by sortID[pID].add(tID)
Sample.sol#L1276-L1300
- ID-10 HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]) ignores return value by rewardID[periodID].add(tID)
Sample.sol#L1409-L1440
- ID-11 HoldEarn.withdrawAll(uint256) ignores return value by hasClaimDid[msg.sender][pID].add(dID)
Sample.sol#L1581-L1614
- ID-12 HoldEarn.removeToken(uint256,uint256) ignores return value by removeID[pID].add(tID)
Sample.sol#L1302-L1319
- ID-13 HoldEarn.dealArray(uint256,uint256,address[]) ignores return value by sortUsers[pID][tID].add(user)
Sample.sol#L1740-L1766
- ID-14 HoldEarn.deposit(uint256,uint256) ignores return value by remainDid[msg.sender][pID].add(id)
Sample.sol#L1456-L1475
- ID-15 HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]) ignores return value by sortID[periodID].add(tID)
Sample.sol#L1409-L1440
- ID-16 HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256) ignores return value by sortID[pID].add(tID)
Sample.sol#L1321-L1368
- ID-17 HoldEarn.dealArray(uint256,uint256,address[]) ignores return value by sortUsers[pID][tID].add(user)
Sample.sol#L1740-L1766
- ID-18 HoldEarn.removeToken(uint256,uint256) ignores return value by sortID[pID].remove(tID)
Sample.sol#L1302-L1319
- ID-19 HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256) ignores return value by sortID[pID].remove(tID)
Sample.sol#L1321-L1368
- ID-20 HoldEarn.deposit(uint256,uint256) ignores return value by users[pID].add(msg.sender)
Sample.sol#L1456-L1475
- ID-21 HoldEarn.withdrawAll(uint256) ignores return value by remainDid[msg.sender][pID].remove(remainDid[msg.sender][pID].at(0))
Sample.sol#L1581-L1614
- ID-22 HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256) ignores return value by rewardID[pID].remove(tID)
Sample.sol#L1321-L1368
- ID-23 HoldEarn.addToken(uint256,HoldEarn.RewardTokenInfo) ignores return value by rewardID[pID].add(tID)
Sample.sol#L1276-L1300
events-access
Impact: Low Confidence: Medium
- ID-24 Operator.setOperator(address) should emit an event for:
Sample.sol#L1088-L1090
missing-zero-check
Impact: Low Confidence: Medium
- ID-25 HoldEarn.setSortAccount(address).account lacks a zero-check on : - sortAccount = account
Sample.sol#L1246
- ID-26 Operator.setOperator(address).operator_ lacks a zero-check on : - operator = operator_
Sample.sol#L1088
reentrancy-benign
Impact: Low Confidence: Medium
-
ID-27 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
- _transferOut(proAddress,periodInfo[pID].defaultToken,periodState[pID].totalDefaultAmount)
-
_transferOut(proAddress,periodInfo[pID].defaultToken,periodState[pID].totalDefaultAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- rewardTokenInfo[pID][tID].perAmount = rewardTokenInfo[pID][tID].totalAmount.mul(muti).div(periodState[pID].totalAmount)
Sample.sol#L1506-L1545
-
ID-28 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_3].rewardToken,rewardTokenInfo[pID][tID_scope_3].totalAmount)
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_3].rewardToken,rewardTokenInfo[pID][tID_scope_3].totalAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- returnDefaultAmount[pID] = periodState[pID].totalDefaultAmount
- returnDefaultAmount[pID] = value
- returnRewardAmount[pID][tID_scope_3] = rewardTokenInfo[pID][tID_scope_3].totalAmount
Sample.sol#L1506-L1545
- ID-29 Reentrancy in HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]): External calls:
Sample.sol#L1409-L1440
- ID-30 Reentrancy in HoldEarn.deposit(uint256,uint256): External calls:
Sample.sol#L1456-L1475
-
ID-31 Reentrancy in HoldEarn.deposit(uint256,uint256): External calls:
- IERC20(periodInfo[pID].userToken).safeTransferFrom(msg.sender,address(this),amount) State variables written after the call(s):
- userBet[msg.sender][pID].totalAmount = userBet[msg.sender][pID].totalAmount.add(amount)
- id = ++ userBet[msg.sender][pID].dID
- userInfo[msg.sender][pID][id].amount = amount
- userInfo[msg.sender][pID][id].depositTime = block.timestamp
Sample.sol#L1456-L1475
-
ID-32 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- returnRewardAmount[pID][tID_scope_1] = rewardTokenInfo[pID][tID_scope_1].totalAmount
Sample.sol#L1506-L1545
reentrancy-events
Impact: Low Confidence: Medium
- ID-33 Reentrancy in HoldEarn.addToken(uint256,HoldEarn.RewardTokenInfo): External calls:
Sample.sol#L1276-L1300
- ID-34 Reentrancy in HoldEarn.withdrawAll(uint256): External calls:
Sample.sol#L1581-L1614
-
ID-35 Reentrancy in HoldEarn.update(uint256): External calls:
- _periodPrize(pID,false)
-
_periodPrize(pID,false)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- PeriodUpdate(pID)
Sample.sol#L1477-L1504
-
ID-36 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,periodInfo[pID].defaultToken,periodInfo[pID].perDefaultAmount)
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,periodInfo[pID].perDefaultAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ClaimDefaultReward(msg.sender,periodInfo[pID].defaultToken,pID,periodInfo[pID].perDefaultAmount)
Sample.sol#L1669-L1708
-
ID-37 Reentrancy in HoldEarn.deposit(uint256,uint256): External calls:
- IERC20(periodInfo[pID].userToken).safeTransferFrom(msg.sender,address(this),amount)
- update(pID)
-
update(pID)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- Deposit(msg.sender,periodInfo[pID].userToken,pID,id,amount,userInfo[msg.sender][pID][id].depositTime)
- PeriodUpdate(pID)
- PeriodUpdate(pID)
Sample.sol#L1456-L1475
-
ID-38 Reentrancy in HoldEarn.transferTo(address,address,uint256): External calls:
- IERC20(token).safeTransfer(account,amount) External calls sending eth:
- address(account).transfer(amount) Event emitted after the call(s):
- TransferTo(address(token),account,amount)
Sample.sol#L1442-L1454
-
ID-39 Reentrancy in HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256): External calls:
- _transferOut(msg.sender,rToken,amount)
- IERC20(token).safeTransferFrom(msg.sender,address(this),tokenAmount) External calls sending eth:
-
_transferOut(msg.sender,rToken,amount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ChangeToken(pID,tID,rToken,token,amount,tokenAmount,tType)
Sample.sol#L1321-L1368
-
ID-40 Reentrancy in HoldEarn.update(uint256): External calls:
- _periodPrize(pID,true)
-
_periodPrize(pID,true)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- PeriodUpdate(pID)
Sample.sol#L1477-L1504
-
ID-41 Reentrancy in HoldEarn.removeToken(uint256,uint256): External calls:
- IERC20(rewardTokenInfo[pID][tID].rewardToken).safeTransfer(msg.sender,rewardTokenInfo[pID][tID].totalAmount) External calls sending eth:
- address(msg.sender).transfer(rewardTokenInfo[pID][tID].totalAmount) Event emitted after the call(s):
- RemoveToken(rewardTokenInfo[pID][tID].rewardToken,rewardTokenInfo[pID][tID].totalAmount,pID,tID)
Sample.sol#L1302-L1319
-
ID-42 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ClaimSortReward(msg.sender,rewardTokenInfo[pID][tID].rewardToken,pID,tID,sReward)
Sample.sol#L1669-L1708
- ID-43 Reentrancy in HoldEarn.addNewPeriod(HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]): External calls:
Sample.sol#L1409-L1440
-
ID-44 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- _transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ClaimBaseReward(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,pID,tID_scope_0,bReward)
Sample.sol#L1669-L1708
timestamp
Impact: Low Confidence: Medium
- ID-45 HoldEarn.checkNewPeriod(address,HoldEarn.PeriodInfo,HoldEarn.RewardTokenInfo[]) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1783-L1819
-
ID-46 HoldEarn.getStatus(uint256) uses timestamp for comparisons Dangerous comparisons:
- block.timestamp < periodInfo[pID].startTime
- periodInfo[pID].startTime <= block.timestamp && periodState[pID].endTime == 0 && block.timestamp < periodInfo[pID].startTime.add(periodInfo[pID].periodTime)
- (periodState[pID].endTime != 0 && periodState[pID].endTime <= block.timestamp || block.timestamp >= periodInfo[pID].startTime.add(periodInfo[pID].periodTime)) && ! periodState[pID].isSort
- periodState[pID].endTime != 0 && periodState[pID].endTime <= block.timestamp && periodState[pID].isSort
Sample.sol#L1864-L1892
- ID-47 HoldEarn.checkDeposit(address,uint256,uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1769-L1781
- ID-48 HoldEarn.update(uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1477-L1504
- ID-49 HoldEarn.withdrawAll(uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1581-L1614
- ID-50 HoldEarn.checkSetMinNum(address,uint256,uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1617-L1636
- ID-51 HoldEarn.checkWithdraw(address,uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L2030-L2051
- ID-52 HoldEarn.check(address,uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1910-L1914
- ID-53 HoldEarn.checkBase(address,uint256) uses timestamp for comparisons Dangerous comparisons:
Sample.sol#L1227-L1234
assembly
Impact: Informational Confidence: High
- ID-54 EnumerableSet.values(EnumerableSet.UintSet) uses assembly
Sample.sol#L687-L697
- ID-55 Address._revert(bytes,string) uses assembly
Sample.sol#L354-L366
- ID-56 EnumerableSet.values(EnumerableSet.AddressSet) uses assembly
Sample.sol#L613-L623
dead-code
Impact: Informational Confidence: Medium
- ID-57 Context._msgData() is never used and should be removed
Sample.sol#L1009-L1011
low-level-calls
Impact: Informational Confidence: High
- ID-58 Low level call in Address.functionCallWithValue(address,bytes,uint256,string):
Sample.sol#L251-L260
- ID-59 Low level call in Address.sendValue(address,uint256):
Sample.sol#L183-L188
- ID-60 Low level call in Address.functionStaticCall(address,bytes,string):
Sample.sol#L278-L285
- ID-61 Low level call in Address.functionDelegateCall(address,bytes,string):
Sample.sol#L303-L310
naming-convention
Impact: Informational Confidence: High
- ID-62 Constant Operator.baseRate is not in UPPER_CASE_WITH_UNDERSCORES
Sample.sol#L1081
- ID-63 Function IERC20Permit.DOMAIN_SEPARATOR() is not in mixedCase
Sample.sol#L129
- ID-64 Constant HoldEarn.muti is not in UPPER_CASE_WITH_UNDERSCORES
Sample.sol#L1123
reentrancy-unlimited-gas
Impact: Informational Confidence: Medium
-
ID-65 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
-
_transferOut(proAddress,periodInfo[pID].defaultToken,periodState[pID].totalDefaultAmount)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(proAddress,periodInfo[pID].defaultToken,periodState[pID].totalDefaultAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- rewardTokenInfo[pID][tID].perAmount = rewardTokenInfo[pID][tID].totalAmount.mul(muti).div(periodState[pID].totalAmount)
-
_transferOut(proAddress,periodInfo[pID].defaultToken,periodState[pID].totalDefaultAmount)
Sample.sol#L1506-L1545
-
ID-66 Reentrancy in HoldEarn._getReward(uint256): External calls:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- address(user).transfer(amount) External calls sending eth:
- _transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,bReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- j < rewardID[pID].length()
- userBet[msg.sender][pID].bTid.push(tID_scope_0)
- userReward[msg.sender][pID][tID_scope_0].claimBase = bReward Event emitted after the call(s):
- ClaimBaseReward(msg.sender,rewardTokenInfo[pID][tID_scope_0].rewardToken,pID,tID_scope_0,bReward)
Sample.sol#L1669-L1708
-
ID-67 Reentrancy in HoldEarn.setDefaultToken(uint256,address,uint256): External calls:
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,beforeAmount)
- address(user).transfer(amount) External calls sending eth:
- _transferOut(msg.sender,periodInfo[pID].defaultToken,beforeAmount)
-
_transferIn(msg.sender,token,afterAmount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- periodInfo[pID].defaultToken = token
- periodInfo[pID].perDefaultAmount = perAmount
- periodState[pID].totalDefaultAmount = afterAmount
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,beforeAmount)
Sample.sol#L1392-L1406
-
ID-68 Reentrancy in HoldEarn.deposit(uint256,uint256): External calls:
-
update(pID)
- address(user).transfer(amount) External calls sending eth:
-
update(pID)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- Deposit(msg.sender,periodInfo[pID].userToken,pID,id,amount,userInfo[msg.sender][pID][id].depositTime)
-
update(pID)
Sample.sol#L1456-L1475
-
ID-69 Reentrancy in HoldEarn._getReward(uint256): External calls:
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,periodInfo[pID].perDefaultAmount)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,periodInfo[pID].perDefaultAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ClaimDefaultReward(msg.sender,periodInfo[pID].defaultToken,pID,periodInfo[pID].perDefaultAmount)
-
_transferOut(msg.sender,periodInfo[pID].defaultToken,periodInfo[pID].perDefaultAmount)
Sample.sol#L1669-L1708
-
ID-70 Reentrancy in HoldEarn.update(uint256): External calls:
-
_periodPrize(pID,false)
- address(user).transfer(amount) External calls sending eth:
-
_periodPrize(pID,false)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- PeriodUpdate(pID)
-
_periodPrize(pID,false)
Sample.sol#L1477-L1504
-
ID-71 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_3].rewardToken,rewardTokenInfo[pID][tID_scope_3].totalAmount)
- address(user).transfer(amount) External calls sending eth:
- _transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_3].rewardToken,rewardTokenInfo[pID][tID_scope_3].totalAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- returnDefaultAmount[pID] = periodState[pID].totalDefaultAmount
- returnDefaultAmount[pID] = value
- returnRewardAmount[pID][tID_scope_3] = rewardTokenInfo[pID][tID_scope_3].totalAmount
Sample.sol#L1506-L1545
-
ID-72 Reentrancy in HoldEarn._periodPrize(uint256,bool): External calls:
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- returnRewardAmount[pID][tID_scope_1] = rewardTokenInfo[pID][tID_scope_1].totalAmount
-
_transferOut(proAddress,rewardTokenInfo[pID][tID_scope_1].rewardToken,rewardTokenInfo[pID][tID_scope_1].totalAmount)
Sample.sol#L1506-L1545
-
ID-73 Reentrancy in HoldEarn.withdrawAll(uint256): External calls:
-
_transferOut(msg.sender,periodInfo[pID].userToken,amount)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(msg.sender,periodInfo[pID].userToken,amount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- WithdrawAll(msg.sender,pID,num,amount)
-
_transferOut(msg.sender,periodInfo[pID].userToken,amount)
Sample.sol#L1581-L1614
- ID-74 Reentrancy in HoldEarn.removeToken(uint256,uint256): External calls:
Sample.sol#L1302-L1319
-
ID-75 Reentrancy in HoldEarn.setRewardToken(uint256,uint256,address,uint256,uint256): External calls:
-
_transferOut(msg.sender,rToken,amount)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(msg.sender,rToken,amount)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- ChangeToken(pID,tID,rToken,token,amount,tokenAmount,tType)
-
_transferOut(msg.sender,rToken,amount)
Sample.sol#L1321-L1368
-
ID-76 Reentrancy in HoldEarn.transferTo(address,address,uint256): External calls:
- address(account).transfer(amount) Event emitted after the call(s):
- TransferTo(address(token),account,amount)
Sample.sol#L1442-L1454
-
ID-77 Reentrancy in HoldEarn.update(uint256): External calls:
-
_periodPrize(pID,true)
- address(user).transfer(amount) External calls sending eth:
-
_periodPrize(pID,true)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) Event emitted after the call(s):
- PeriodUpdate(pID)
-
_periodPrize(pID,true)
Sample.sol#L1477-L1504
-
ID-78 Reentrancy in HoldEarn._getReward(uint256): External calls:
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- address(user).transfer(amount) External calls sending eth:
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
- address(user).transfer(amount)
- (success,returndata) = target.call{value: value}(data) State variables written after the call(s):
- userBet[msg.sender][pID].sTid.push(tID)
- userReward[msg.sender][pID][tID].claimSort = sReward Event emitted after the call(s):
- ClaimSortReward(msg.sender,rewardTokenInfo[pID][tID].rewardToken,pID,tID,sReward)
-
_transferOut(msg.sender,rewardTokenInfo[pID][tID].rewardToken,sReward)
Sample.sol#L1669-L1708
unused-state
Impact: Informational Confidence: High
- ID-79 Operator.baseRate is never used in HoldEarn
Sample.sol#L1081