OpenWorld security record

In `OpenWorld.sol`, the contract inherits `ERC20PausableUpgradeable` and uses extensively the `whenNotPaused` modifier to prevent many functions from being called if the contract is paused. \ However, the contract does not implement any function allowing to set `_paused` as true. Therefore the contract is not pausable.

In `OpenWorld.sol`, the function `burn()` is the only function allowing any user to modify the state of the contract `OPEN` (under specific conditions) that is not pausable.

In `RewardRouterV2.sol`, the function `_unstakeOpen()` computes a `reductionAmount` to burn as follow: ```solidity=695 uint256 reductionAmount = stakedBnOpen.mul(_amount).div( balance ); ``` if `stakedBnOpen.mul(_amount) < balance` then the burnt amount will be zero.

In `OpenWorld.sol`, the state variable `stakerAddress` is defined and can be set to any address, however, it is never used.

Boolean constants can be used directly and do not need to be compared to true or false. --- ```solidity=45 require( tokenBlacklist[msg.sender] == false && tokenBlacklist[_to] == false, "Blacklist address cannot transfer" ); ``` --- ```solidity=50 require( isContractTransferBlock(msg.sender, _to) == false, "This address cannot send to ContractBlacklist Address" ); ``` --- ```solidity=54 require( isContractTransferBlock(_to, msg.sender) == false, "This address cannot receive from ContractBlacklist Address" ); ``` --- ```solidity=81 require( tokenBlacklist[_from] == false && tokenBlacklist[_to] == false, "Blacklist address cannot transfer" ); ``` --- ```solidity=86 require( tokenBlacklist[msg.sender] == false, "Blacklist address cannot transfer" ); ``` --- ```solidity=91 require( isContractTransferBlock(_from, _to) == false, "This address cannot send to ContractBlacklist Address" ); ``` --- ```solidity=95 require( isContractTransferBlock(_to, _from) == false, "This address cannot receive from ContractBlacklist Address" ); ```

In `OpenWorld.sol`, the function `transferFrom()` performs two checks returning the same error message: ```solidity=81 require( tokenBlacklist[_from] == false && tokenBlacklist[_to] == false, "Blacklist address cannot transfer" ); require( tokenBlacklist[msg.sender] == false, "Blacklist address cannot transfer" ); ```

In `OpenWorld.sol`, the function `initialize()` takes an address as a parameter named `owner_`. This parameter will be used to set the `feeAddress` and will receive all the `INITIAL_SUPPLY`. \ `OwnableUpgradeable.__Ownable_init();` will set the initializer address as the `owner` of the contract. The name `owner_` could lead one to think that the address provided will be the owner of the contract when it is not the case.

In `OpenWorld.sol`, There are no upper boundaries for `setSellFeeRate()`, it is possible to set `sellFeeRate` up to any arbitrary amount. \ However, if `sellFeeRate > 1000` then `getValuesWithSellRate()` might fail unexpectedly, preventing `transfer()` and `transferFrom()` to work correctly. ----- In `OpenStaking.sol`, there are no upper boundaries for `setUnstakingThreshold()`, it is possible to set `unstakingThreshold` up to any arbitrary value. \ If `unstakingThreshold` is set to a very high value then `unstake()` will fail before the threshold is passed, preventing users from unstaking their tokens.

In `RewardRouterV2.sol`, the function `batchStakeOpenForAccount()` does not check that `_accounts` and `_amounts` have the same length.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.