EverRise

In the contract `DAppSocialPoolController` the role `_adminList` has authority over the functions shown in the diagram below.  - `createTgtRecord(uint256 id, address tokenAddress, address fromAddress, address toAddress, uint256 amount, bool isWalletTransfer)`: This function creates a target record. Only an admin can call this function. - `updateSrcAmount(uint256 id, address tokenAddress, address fromAddress, address toAddress, uint256 amount, uint256 releaseAmount)`: This function updates the source amount. Only an admin can call this function. - `cancelSrcRequest(uint256 id, address tokenAddress, address fromAddress, uint256 amount)`: This function cancels the source request. Only an admin can call this function. - `cancelTgtRequest(uint256 id, address tokenAddress, address fromAddress, uint256 amount)`: This function cancels the target request. Only an admin can call this function. In the contract `DAppSocialPoolController` the role `_owner` has authority over the functions shown in the diagram below.  - `setCrossXOpen(bool isOpen)`: This function sets the status of CrossX. Only the contract owner can call this function. - `setPoolModel(address newModel)`: This function sets the pool model contract. Only the contract owner can call this function. - `addSupportedToken(address tokenAddress)`: This function adds a supported token to the contract. Only the contract owner can call this function. - `removeSupportedToken(address tokenAddress)`: This function removes a supported token from the contract. Only the contract owner can call this function. - `addAdmin(address newAddress)`: This function adds a new admin to the contract. Only the contract owner can call this function. - `removeAdmin(address oldAddress)`: This function removes an admin from the contract. Only the contract owner can call this function. ----- In the contract `DAppSocialPoolModel` the role `_adminList` has authority over the functions shown in the diagram below.  - `addSupportedToken(address tokenAddress)`: Adds a new supported token to the `_supportedTokens` list. Only an admin can call this function. - `removeSupportedToken(address tokenAddress)`: Removes a supported token from the `_supportedTokens` list. Only an admin can call this function. - `transferNative(address from, address to, uint256 amount)`: Transfers native tokens from one address to another. Only an admin can call this function. - `transferTokens(address tokenAddress, address from, address to, uint256 amount, bool isWalletTransfer)`: Transfers a specific ERC20 token from one address to another. Only an admin can call this function. - `transferPendingTokens(address tokenAddress, address from, address to, uint256 amount)`: Transfers pending tokens from one address to another. Only an admin can call this function. - `holdTokens(address tokenAddress, address from, uint256 amount)`: Holds a specified amount of a specific ERC20 token for a user. Only an admin can call this function. - `holdTokensWithFee(address tokenAddress, address from, uint256 amount, uint256 feeAmount)`: Holds a specified amount of a specific ERC20 token for a user, with a fee. Only an admin can call this function. - `releaseTokens(address tokenAddress, address from, uint256 amount)`: Releases held tokens of a specific ERC20 token for a user. Only an admin can call this function. In the contract `DAppSocialPoolModel` the role `_owner` has authority over the functions shown in the diagram below.  - `addAdmin(address newAddress)`: Adds a new admin to the `_adminList`. Only the contract owner can call this function. - `removeAdmin(address oldAddress)`: Removes an admin from the `_adminList`. Only the contract owner can call this function. - `setFeeAddress(address newAddress)`: Changes the fee address. Only the contract owner can call this function. - `updateExchange(address newAddress)`: Changes the exchange address. Only the contract owner can call this function. In the contract `DAppSocialPoolModel` the role `exchangeAddress` has authority over the functions shown in the diagram below.  - `transferETH(address from, addr

In the contract `DAppSocialPoolModel`, the accounts in `_adminList` and the one corresponding to `exchangeAddress` have the authority to update the token balance of an arbitrary account without sanity restriction. Any compromise to any of these accounts may allow a hacker to take advantage of this authority and manipulate users' balances by, e.g.: - moving locked funds from pending balances to current ones; - freely moving funds from an arbitrary account to another.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. --- ```solidity=263 function depositTokens(address tokenAddress, uint256 amount) external validAmount(amount) { ``` - The function `DAppSocialPoolModel.depositTokens` interacts with third party contract with `IERC20` interface via `tokenAddress`. --- ```solidity=293 function withdrawTokens(address tokenAddress, uint256 amount) external tokensLock(msg.sender) validAmount(amount) enoughBalance(amount, _tokenBalances[tokenAddress][msg.sender]) { ``` - The function `DAppSocialPoolModel.withdrawTokens` interacts with third party contract with `IERC20` interface via `tokenAddress`. --- ```solidity=328 function withdrawTokensWithAlt(address tokenAddress, address from, uint256 amount) external validAmount(amount) enoughBalance(amount, _tokenBalances[tokenAddress][msg.sender]) { ``` - The function `DAppSocialPoolModel.withdrawTokensWithAlt` interacts with third party contract with `IERC20` interface via `tokenAddress`. --- ```solidity=361 function transferTokens(address tokenAddress, address from, address to, uint256 amount, bool isWalletTransfer) external adminOnly validAmount(amount) enoughBalance(amount, _tokenBalances[tokenAddress][from]) { ``` - The function `DAppSocialPoolModel.transferTokens` interacts with third party contract with `IERC20` interface via `tokenAddress`.