Seedify.fund (nft-vanguards)

In the `BlackBoxVang` contract, the `withdraw()` function allows a user to withdraw Ethers from the contract to its own address. There are no access control on the `withdraw()` function. That means any user can call the function and receive Ethers. The amount can be withdrawn is the input parameter of the function. There are no limits on the amount as well. Therefore any user can call the `withdraw()` function and drain all Ethers from the contract.

`Vanguard` is an upgradeable contracts, the proxy owner can upgrade the contract without the community's commitment. If a malicious user compromises the account, the user can change the implementation of the contract and potentially drain tokens from the contract.

In the `findBox()` function, there is an input parameter called `allocation`, which is used for validating the merkle proof as well as for assigning the `userMints[msg.sender].allocation` value. Our understanding is that a user cannot randomly input an `allocation` value otherwise the user cannot pass the proof validation check. However, the mapping of user addresses and allowed `allocation` is not saved in the contract. We would like to learn how is the initial allocation value determined, and how can users learn about the mapping of their addresses and the legit `allocation` values for them.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=73 vanguardContract = _vanguardContract; ``` - `_vanguardContract` is not zero-checked before being used. --- ```solidity=78 boxContractAddress = contractAddress; ``` - `contractAddress` is not zero-checked before being used.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby the attacker can perform privileged operations that either indirectly break the proxy by destroying the logic contract or trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=11 contract Vanguard is ``` - `Vanguard` is an upgradeable contract that does not protect its initializer. ```solidity=23 function initialize() external initializer { ``` - `initialize` is an unprotected initializer function.