MELD - ERC20 Audit

The contract `BaseToken` adopts the eip-2771 standard which overrides the function `_msgSender()` and uses the last 20 bytes of the call data instead of `msg.sender` if the `msg.sender` is the forwarder. Meanwhile, the function `_checkRole()` in the OpenZeppelin contract `AccessControl` is using the function `_msgSender()` for the role checks. Thus, the forwarder can forge the value of _msgSender() and effectively send transactions from privileged addresses.

According to the following code snippet in the function `mint()`, each new minter will start a new minting period in the first mint, and any further mint operation from this minter within the period cannot exceed the threshold limit. The first mint operation after the period will clear the minted amount(`currentMintingAmount[minter]`) and start a new period, so the minter can mint more tokens below the threshold. If the `mintingPeriodLength[minter]` is set to 0, this logic is like a maximum mint limit for a single mint transaction. ```solidity=113 if (block.timestamp > lastMintingPeriod[minter] + mintingPeriodLength[minter]) { currentMintingAmount[minter] = 0; lastMintingPeriod[minter] = block.timestamp; } require( currentMintingAmount[minter] + _amount <= mintingAmountThreshold[minter], "BaseToken: Minting amount exceeds threshold" ); currentMintingAmount[minter] += _amount; ```

The cited addresses input are missing a check that it is not `address(0)`. For example: - `_token` in the `RescueTokens._rescueERC20()`, `RescueTokens._rescueERC721()`, `RescueTokens._rescueERC1155()`. - `_defaultAdmin` in the `BaseToken.constructor()`. - `_account` in the `BaseToken.setMintingAccount()`. - `_forwarder` in the `BaseToken.setTrustedForwarder()`.

The linked variable `__decimals` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.