W3-Macondo

The contract `MacondoMCDVestingEcosystemWallet` is importing and inheriting from contracts that are outside the scope of this audit. The scope of the audit treats these entities as black boxes and assumes their functional correctness. However, in the real world, these contracts could have security issues and this may lead to exploits.

The linked functions are `internal` and never used in the scope of this audit.

In the contract `OnChainRandomUpgradeable.sol`, the function `_getRandom()` is supposed to return a random number. \ To do so the many parameter will be encoded and then the hash of the encoding is computed to return an `uint256`. The parameters used seem to be potentially influenceable, for example: - `_index` and `msg.sender` can be chosen - `blockhash` and `block.difficulty` can be influenced by miners to some degree or predicted. Although this function is internal, so the whole context of use is not inside the scope of this audit ; using block variables to generate randomness is considered bad practice and is not recommended.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=12 VRFCoordinatorV2Interface COORDINATOR; ``` - The contract `RandomOracleConsumer` interacts with third party contract with `VRFCoordinatorV2Interface` interface via `COORDINATOR`.

Literals with many digits are difficult to read and review. ```solidity=35 uint32 callbackGasLimit = 300000; ``` --- ```solidity=37 _mint(msg.sender, 1000000000 * 10**decimals()); ```

The `SafeMathUpgradeable` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

```solidity=19 error ErrorSaleRoleSignature(address signer); ``` - `ErrorSaleRoleSignature` is declared but never used. --- ```solidity=20 error ErrorSaleRoleCannotSaleToSelf(); ``` - `ErrorSaleRoleCannotSaleToSelf` is declared but never used.

In the contract `OnChainRandomUpgradeable`, the function `_getRandomBySeed()` depends on only two parameters, it cannot be considered as truly random since the result could be easily predictable. ---- In the contract `PokerValidator`, the function `_getRandom()` depends on `OnChainRandomUpgradeable._getRandomBySeed()` to return a value, since the result would still be easily predictable the function cannot be considered as truly random.