Block Agent security record

It was observed that the Bonusblock contracts do not leverage ERC165 standard. Using ERC165 assures that a contract deployed to a given address implements expected functionalities. It also indirectly performs a check for zero-address. Using ERC165 is not a requirement for a contract to be implemented correctly, however using it limits the impact of a human error during contract's configuration and it is considered a good practice.

The function safeMint() indirectly performs an arbitrary external call through ERC721's _safeMint(), and does not follow the Checks-Effects-Interactions pattern nor does it implement verification mechanisms against reentrancy, such as OpenZeppelin's ReentrancyGuard.While it does not present an immediate security threat as it is, when further functionality is introduced, possible reentrancy scenarios may occur that may ultimately lead to financial loss on the protocol.

It was observed that both RewardsBank and MyToken ERC721 contract implement a verifySignature function. The logic of these functions is the same in both contracts. In consequence, both contracts contain this functionality, which makes them more expensive to deploy and operate. Although it is not a security vulnerability, it is considered a best practice for code quality and gas optimization to keep the shared functionalities in a library so that it is only deployed once on-chain and code can be reused.