OpenWorld security record

States variables should be updated before making an external call to another contract. Interacting with external contracts increases the complexity of a function and makes its behavior less predictable. Following the check effect interaction pattern allows for preventing unexpected mistakes.

External calls are made inside a *for* loop. This might lead to a denial-of-service, if any of the calls fail, it will cause the entire loop to revert.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

The return value of the transfer()/transferFrom() call is not checked.

In `OpenStaking.sol`, the functions `submit()` and `_submit()` take an address `_referral` as an input parameter. This address is only used during an event emission and has no effect on the logic of the contract. Could you please provide us with more information about how this variable will be used off-chain?

In `OpenWorld.sol`, the contract `OPEN` does not protect its initializer. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. --- ```solidity=6 contract OPEN is ERC20PausableUpgradeable, OwnableUpgradeable { ``` - `OPEN` is an upgradeable contract that does not protect its initializer. ```solidity=31 function initialize(address owner_) public initializer { ``` - `initialize` is an unprotected initializer function.

The return value of an external call is not stored in a local or state variable.

The linked function is equivalent to the compiler-generated getter function for the respective variable.

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.