Ommniverse security record

In the contract **Governance**, the role **Owner** has authority over the following functions: - function createProposal(), to create a proposal. - function executeProposal(), to execute a proposal. Any compromise to the **Owner** account may allow a hacker to take advantage of this authority. In the contract **Fractions**, the role **Owner** has authority over the following functions: - function addMinter(), to add the address `minter` as the `Minter` role. - function removeMinter(), to remove the address `minter` from the `Minter` role. - function updateBaseUri(), to update the base URI of the fractions. Any compromise to the **Owner** account may allow a hacker to take advantage of this authority. In the contract **Fractions**, the role **Minter** has authority over the following functions: - function mint(), to mint any amount of fractions to any address. Any compromise to the **Minter** account may allow a hacker to take advantage of this authority. In the contract **NftVaultFactory**, the role **Owner** has authority over the following functions: - function setFeeReceiver(), to update the fee receiver. - function setFee(), to update the fee. Any compromise to the **Owner** account may allow a hacker to take advantage of this authority. In the contract **Ommniverse**, the role **Owner** has authority over the following functions: - function pause(), to return the contract to a normal state. - function unpause(), to trigger a stopped state. - function mint(), to mint `OMMI` ERC20 tokens to any address. Any compromise to the **Owner** account may allow a hacker to take advantage of this authority. In the contract **VaultFactory**, the role **Owner** has authority over the following functions: - function setFeeReceiver(), set update the fee receiver. - function setFee(), to update the fee. - setAuctionLength(), to update the auction length. Any compromise to the **Owner** account may allow a hacker to take advantage of this authority.

`Fractions`,`NftVault`, `NftVaultFactory`,`OmmniverseCollection`,`Ommniverse`,`Vault`, and `VaultFactory` are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

All calls of the form `transferFrom(from, dest, amount)` where the `dest` address is zero will fail. ```solidity OmmniToken.transferFrom(msg.sender, address(0), burn) ```

The `vote()` function allows token holders to vote on proposals, and the number of votes cast depends on the user's total quantity of voting tokens. Although each user can only vote once, the voting tokens are not locked, allowing the holder of the voting tokens freely transfer the voting tokens to any address after casting the vote, giving that address more voting power and potentially manipulating the voting outcome. ```solidity=108 function vote(uint256 _proposalId, bool _vote) public { require(proposals[_proposalId].votingPeriod > block.timestamp); require(!voters[_proposalId][msg.sender], "Already voted"); if (_vote) { voteTotals[_proposalId].yes += token.balanceOf(msg.sender); } else { voteTotals[_proposalId].no += token.balanceOf(msg.sender); } voters[_proposalId][msg.sender] = true; emit VoteCast(_proposalId, msg.sender, _vote); } ```

In the function `end`, the fee sent to the fee receiver is not correctly calculated, there is a duplicated `liveprice` multiplied in the calculation formula. ```solidity _sendOmmi( ISettings(settings).feeReceiver(), livePrice * livePrice * ((ISettings(settings).fee()) / 1000) ); ```

The variable `address(this).balance` is being used to calculate the share of the `Ommni` token is incorrect. `address(this).balance` represents the balance of ETH in the contract `Vault`, it should use the balance of the `Ommni` token. ```solidity=204 fractionValue = address(this).balance / IFERC1155(fractions).totalSupply(fractionsID); ``` ```solidity=215 uint256 share = bal * fractionValue; IFERC1155(fractions).burn(msg.sender, fractionsID, bal); _sendOmmni(msg.sender, share); ```

The parameter `address(this)` passed in function `IFERC1155(fractions).mint()` is incorrect, the parameter should be the address of the vault. ```solidity=89 uint256 fractionId = IFERC1155(fractions).mint(address(this), _amount); ``` ```solidity=46 function mint( address vault, uint256 amount ) external onlyMinter returns (uint256) { count++; idToVault[count] = vault; _mint(msg.sender, count, amount, "0"); _totalSupply[count] = amount; return count; } ```

As per the code comments of the `start()` function, `reservePrice` in `OMMI` must be sent to the contract from the caller. Hence there should be a validation of the amount to ensure that the starting auction price is not smaller than the reserve price.

In the `buyFraction()` function, there should be a validation to ensure that users can only buy NFT fractions before the NFT auction starts.

There is no validation that an existing vesting schedule was created for the beneficiary, so the previous vesting schedule of the beneficiary will be overwritten. ```solidity=37 mapping(address => VestingSchedule) vestingSchedules; ``` ```solidity=88 vestingSchedules[_beneficiary] = VestingSchedule( _beneficiary, _start, cliff, _duration, _slicePeriodSeconds, _amount, 0 ); ```