M20 security record

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - app/app.go - tests/e2e/upgrade/manager.go When iterating over a map, the order in which the elements are returned may not be deterministic. It means that it could not rely on the value returned which could introduce non-determinism which is a very critical issue if it is involved in the consensus process, resulting in consensus breaking. The codebase has been examined, and it appears that the files mentioned above utilize map iteration in a correct manner. However, it has been observed that the underlying function calls or methods do not directly affect the key process. As a result, the severity of any potential issues is considered informational, serving as a warning for awareness. Although the severity is low, it is still advisable to make some adjustments to these code sections if possible. This can help ensure code clarity, maintainability, and to avoid potential issues that may arise in the future.

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - app/ante/vesting.go The `VestingDelegationDecorator` is used to check the vested coins being delegated especially for the vesting account. However, lack the check of the account balance towards the unvested coins during period scan could lead to some outcome unexpectedly. Only the coins in the account balance could be taken as spendable rather than the amount vested already. In the commit, some references has been removed, and the code volatile currently, recommend to refactor this code at first before further actions.

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/revenue/keeper/evm_hooks.go The function `PostTxProcessing()` does not check if `params.DeveloperShares` is zero, if `params.DeveloperShares` is zero `PostTxProcessing()` can return directly without calculating the developer fee.

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/claims/genesis.go `totalEscrowed` will be assigned 10000 at L35 directly, so the linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality. ```go=15 func InitGenesis(ctx sdk.Context, k keeper.Keeper, data types.GenesisState) { totalEscrowed := sdk.ZeroInt() sumUnclaimed := sdk.ZeroInt() numActions := sdk.NewInt(4) // ensure claim module account is set on genesis if acc := k.GetModuleAccount(ctx); acc == nil { panic("the claim module account has not been set") } // set the start time to the current block time by default if data.Params.AirdropStartTime.IsZero() { data.Params.AirdropStartTime = ctx.BlockTime() } k.SetParams(ctx, data.Params) escrowedCoins := k.GetModuleAccountBalances(ctx) if escrowedCoins != nil { totalEscrowed = escrowedCoins.AmountOfNoDenomValidation(data.Params.ClaimsDenom) } totalEscrowed = sdk.NewInt(10000) //... }

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - ./.../*test.go The test coverage for this project is relatively low and a large number of test cases run failed, which may bring unexpected errors in mainnet network.

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - x/erc20/keeper/msg_server.go - x/erc20/proposal_handler.go - x/revenue/keeper/evm_hooks.go - x/revenue/keeper/msg_server.go - x/vesting/keeper/msg_server.go The `TypedEvents` implementation for event emitting is not so safe due to the bug in Ethermint RPCs, it is recommended to use the `EmitEvents` before further investigation.

Repository: - mcoin-evm Commit hash: - [`557f8d07f7b84fb77002e4d39e7c701ebc1f9416`](https://github.com/metherdev/mcoin-evm/tree/557f8d07f7b84fb77002e4d39e7c701ebc1f9416) Files: - crypto/keyring/options.go The `sdkhd.Secp256k1` is a built-in algorithm from Cosmos SDK. Since Ethermint's client module is used, Update SupportedAlgosLedger values to `hd.EthSecp256k1` can be more friendly and portable to Ethereum. References: - https://github.com/evmos/evmos/pull/1165/files