DaoMax.io security record

The interface `ILazyMint` is defined and used yet not implemented in the audit scope. ```solidity isLazyMint && isPlatformNft(_nftContract) && !ILazyMint(_nftContract).exists(_nftId) ) { ILazyMint(_nftContract).lazyMint( ``` The interface `ILazyMint1155` is only implemented by an abstract contract partially in the audit scope. ```solidity !ILazyMint1155(_nftContract).exists(_nftId) ) { ILazyMint1155(_nftContract).lazyMint( ```

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=14 contract DEX is ``` - `DEX` is an upgradeable contract that does not protect its initializer. ```solidity=21 function initialize( ``` - `initialize` is an unprotected initializer function. --- ```solidity=8 contract Manager is Initializable, IManager { ``` - `Manager` is an upgradeable contract that does not protect its initializer. ```solidity=46 function initialize(address _dao, address _conduitController) external initializer { ``` - `initialize` is an unprotected initializer function. --- ```solidity=10 contract ConduitController is Initializable, IConduitController, ConduitControllerEventsAndErrors { ``` - `ConduitController` is an upgradeable contract that does not protect its initializer. ```solidity=28 function initialize( ``` - `initialize` is an unprotected initializer function.