hypercomic.io - Audit

CertiK8 Nov 2022Files named in the report

CertiK reviewed HYPERCOMIC (hypercomic.io - Audit) on 8 Nov 2022: 10 findings, 0 critical; 6 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open HYPERCOMIC’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	3	1
Medium	0	0	0
Low	1	0	5

HighShould Check `beneficiaryAddress` Is Not In VestFixed

Should check beneficiaryAddress is not in the vesting before setting `_vestingInfos[beneficiaryAddress]` and adding the address into `_vestingWallets`. ```solidity=44 _vestingInfos[beneficiaryAddress] = VestingInfo(amount, startTime, duration, 0); _vestingWallets.push(beneficiaryAddress); ``` Set an existing vesting beneficiaryAddress will overwrite the origin vesting info, `_vestingWallets` will have duplicated recorded as well.

LowConfusing NamingFixed

The variable `unLockAmountRate` in the funtion `_getUnLockAmount` is confusing. It's not a rate.

LowDivide Before MultiplyFixed

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=1072 uint256 unLockAmountRate = timestamp.sub(lockStartTime).div(86400 * 30); //per 30day ``` ```solidity=1079 return lockAmount.mul(unLockAmountRate).div(releaseMonths); ```

LowMissing Emit EventsFixed

The functionw that affects the status of sensitive variables should be able to emit events as notifications: - `function setVestingAmount()` - `function setVestingStartTime()` - `function setVestingDuration()` ---- The functionw that affects the status of sensitive variables should be able to emit events as notifications: - `function setLockReleaseMonths()` - `function setLockStartTime()` - `function setLockAmount()`

LowRedundant codeFixed

`_lockedWallets` is not actually used in the contract `HYCOTokenV2`. It's only set in the function `setLock` but not used in anywhere else.

LowUnnecessary Use of SafeMathFixed

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=719 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=975 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `HYCOTokenV2` contract. ```solidity=1072 uint256 unLockAmountRate = timestamp.sub(lockStartTime).div(86400 * 30); //per 30day ``` - `SafeMath.sub` is called in `_getUnLockAmount` function of `HYCOTokenV2` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 7) are shown above.*