Valinity Audit

```solidity=178 function mint(uint256 amount) public virtual returns (bool) { _mint(_msgSender(), amount); return true; } ``` Any address can call function `mint()` and mint tokens for itself.

```solidity=271 function _splitInviterFee(uint256 amount, address inviter) private returns (uint256 inviterAmount, uint256 remainingAmount) { inviterAmount = _inviterFeeSplit * amount / MULTIPLIER; remainingAmount = amount - inviterAmount; // inviterAmount goes to inviter's credits _memberships[inviter].credits += inviterAmount; // transfer inviterAmount to this contract _makePaymentFromBUSD(inviterAmount, address(this)); // remainingAmount goes to BUSDT _makePaymentFromBUSD(remainingAmount, address(_busdt)); } ``` A user can pay membership fees to activate itself via function `payMembership()` which triggers function `_splitInviterFee()` to increase the inviter's "credits" - the amount of claimable BUSD. Activating `_originMember` would increase the credits of its inviter, which is the zero address that cannot claim those BUSD tokens.

Since function `buybackOffer(uint256 offerId, address seller, uint256 amountBUSD)` does not check if the offer is MFC_BUSD trading pair, it could be used to trade BUSD_MFC pair.

```solidity=65 function createMember(address inviter, uint256 membershipFee) external { require(_memberExist(inviter), "Inviter is not member"); require(!_memberExist(_msgSender()), "Member already exist"); _createMember(_msgSender(), inviter); emit CreateMember(_msgSender(), inviter, block.timestamp); _payMembership(membershipFee); } ``` A user can call function `createMember()` for paying `membershipFee` to register as a whitelisted account. Since function `_payMembership()` only requires `membershipFee` > 0, even 1 Wei of BUSD is enough to call function `createMember()`.