World of Dypians - Audit

In new commit `bcf3c5fa7729f1f59aa9fbf42288f7a36362088e`: All of the `WoD` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the anonymous deployer can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer account that holds undistributed tokens may allow the attacker to steal and sell tokens on the market, resulting in severe damage to the project. ```solidity=704 constructor(uint256 MAX_SUPPLY_TOKEN) Ownable(msg.sender) { MAX_SUPPLY = MAX_SUPPLY_TOKEN; _mint(msg.sender, MAX_SUPPLY_TOKEN); } ```

The function `addVestingWallets` adds wallet addresses and allocates tokens for vesting but misses input validation: - It does not ensure that the `_holder` and `_amountToClaim` arrays are of equal length. - It fails to check that the addresses in `_holder` are unique. - It does not verify that the total of `_amountToClaim` does not exceed the contract's token balance. These shortcomings could lead to invalid or duplicate addresses being added or more tokens being allocated than the contract holds, causing potential logical issues. ```solidity=931 function addVestingWallets(address[] calldata _holders, uint[] calldata _amountToClaim) external onlyOwner { ```

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.