UVToken-Audit 2

In the current implementation, function `InsertUVTPledge` will trigger an external call to a user provided address `_pledgeAddr`. ```solidity=422 function InsertUVTPledge( address _userAddr , uint256 _pledgeAmount, address _pledgeAddr ) external { IPledge IPledge_ = IPledge(_pledgeAddr); bool _isValid; (,,,_isValid) = IPledge_.getPledgeInfo(); require(_isValid,"noValid"); payToken(tokenAddress_, _userAddr, _pledgeAmount); IPledge_.insertUVTPledge(_userAddr, _pledgeAmount); } ``` Calling a user provided address is dangerous, especially in a public function with no access control restriction. An attacker could deploy a malicious contract and use the vulnerable function to trigger a call to the malicious contract. In this case, the attacker can bypass the `_isValid` check in L426 and he can transfer tokens hold by any user to the `IFinance_` account, if the user has approved the `UVTPledge` contract.

The implementation of the `isNotContract` check can not cover all scenarios. The check can be bypassed if the call is from the constructor of a smart contract or when the contract is destroyed. In that case, the codesize will also be zero. The "isContract" function in the OpenZeppelin "Address" library uses the similar implementation, but comments mention that "it's unsafe to rely on the check and it can be bypassed". Reference: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol Bypassing the `isNotContract()` check would introduce potential risks to the project.

The "mint" function lacks access control, allowing any user to call it and transfer uvcToken to miner on a daily basis. The reason for allowing everyone to call the "mint" function is unclear to the auditor and we suggest this function should only be accessible from the contract owner. ```solidity=474 function mint() external CanMint isNotContract(msg.sender) returns(bool) { uint256 nDays = (block.timestamp - lastMint_)/CYCLE_; lastMint_ = lastMint_ + nDays * CYCLE_; uvcToken_.safeTransfer(miner_, nDays * numMint_); return true; } ```

Multiple Solidity versions are used in the codebase. Versions used: `^0.8.4`, `^0.8.7` `^0.8.4` is used in UVToken/uvcMine.sol file. ```solidity=305 pragma solidity ^0.8.4; ``` `^0.8.7` is used in UVToken/uvcMine.sol file. ```solidity=404 pragma solidity ^0.8.7; ```