Galactix Zone security record

- **Make additional note about admin roles too** In the contract `PreSalePool` the role `superAdmin` has authority over the functions shown in the diagram below. Additionally, the `admin` role has authority over functions: - `setPreSaleToken()` - `setBUSDToken()` - `deployNewSalePhase()` - `setSigner()` - `pause()` - `unpause()` - `setPriceFeed()` Any compromise to the `superAdmin` account may allow the hacker to take advantage of this authority and withdraw all presale tokens from the contract, as well as pause the contract or use the other functions to disrupt the correct operation of the contract. The `admin` role also has the ability to disrupt the normal operation of the contract.  --- In the contract `DNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the `treasuryAddress` to a malicious one, as well as pause the contract or use the other functions to disrupt the correct operation of the contract.  --- In the contract `DKeyNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the `treasuryAddress` to a malicious one, as well as pause the contract or use the other functions to disrupt the correct operation of the contract. 

`PreSalePool`, `dNFT`, and `key` are upgradeable contracts; the owner can upgrade these contracts without the community's commitment. If an attacker compromises the account, they can change the implementation of the contract and drain tokens from the contract.

All `GXZ` tokens are sent to an input `_admin` address when deploying the contract. This is a potential centralization risk as the deployer can distribute `GXZ` without the consensus of the community.

Encoding through `abi.encodePacked()` is used with at least two dynamic type inputs controlled by the user. This type of encoding is susceptible to malleability when used with strings, bytes, or other dynamic types. As such, it is not a good choice for signature verification with the input used, since users can change the input and potential get the same bytes output from from `abi.encodePacked`. Moreover, note that uints and other variable types do not need to be converted to strings before being encoded.

One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=56 function initialize( ``` `initialize` has memory location parameters: `_pauseExemptions`, `_taxExemptions`.

In the `__GalactixToken__init_unchained()` function, state variables `commonTaxRate` and `ownerTaxRate` are set without value validation, there will be a risk that the value of these two state variables can be greater than `ONE_HUNDRED_PERCENT`. ```solidity=105 function __GalactixToken__init_unchained( address _admin, uint256 _totalSupply, uint256 _commonTaxRate, uint256 _ownerTaxRate, address _commonTaxRecipient, address _ownerTaxRecipient, address[] memory _pauseExemptions, address[] memory _taxExemptions ) internal onlyInitializing { commonTaxRate = _commonTaxRate; ownerTaxRate = _ownerTaxRate; ``` And in functions `setCommonTaxRate()` and `setOwnerTaxRecipient()`, both of them have a `require` statement to protect the value of tax rate becoming greater than `ONE_HUNDRED_PERCENT(10,000)`, but tax rates are still able to be set with a very big value, e.g. 9999(tax rate 99%). ```solidity=379 function setCommonTaxRate(uint256 _newTaxRate) external onlyOwner { require(_newTaxRate <= ONE_HUNDRED_PERCENT, 'GXZ: invalid tax rate!'); commonTaxRate = _newTaxRate; } function setOwnerTaxRate(uint256 _newTaxRate) external onlyOwner { require(_newTaxRate <= ONE_HUNDRED_PERCENT, 'GXZ: invalid tax rate!'); ownerTaxRate = _newTaxRate; } ```

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

Signed messages are not properly verified with the current **chain ID**, thus allowing attackers to perform replay attacks across chains. Hardcoded or cached chain ID values are also vulnerable since a hard fork may occur and change the chain ID in the future. ```solidity=15 bytes32 messageHash = getMessageHash(_nonce, _salePhase, _signer, _candidate, _BUSDAmount); bytes32 ethSignedMessageHash = getEthSignedMessageHash(messageHash); address signerAddress = getSignerAddress(ethSignedMessageHash, _signature); return signerAddress == _signer; ``` - The library function `verifySignature()`, which eventually calls `ecrecover`. The **chain ID** is not used for creating a signed message hash. ```solidity=17 address signerAddress = getSignerAddress(ethSignedMessageHash, _signature); ``` - Calling `getSignerAddress`, which eventually calls `ecrecover`. ```solidity=36 return ECDSA.recover(_messageHash, _signature); ``` - Calling `ECDSA.recover()` with a hash that does not properly include the chain ID.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=37 IAntisnipe public antisnipe; ``` - The contract `GalactixZoneToken` interacts with third party contract with `IAntisnipe` interface via `antisnipe`.

The smart contract does not check or store the return value of an external call in a local or state variable, which may introduce vulnerabilities due to the unhandled outcome. ```solidity=121 isPauseExempt.add(_admin); ``` --- ```solidity=122 isTaxExempt.add(_admin); ``` --- ```solidity=125 isPauseExempt.add(_pauseExemptions[i]); ``` --- ```solidity=129 isTaxExempt.add(_taxExemptions[i]); ```