Panaroma security record

Currently it seems that the only punishment for users that have been blacklisted is the burning of the blacklisted user funds. The procedure allows for time in between the time when users are blacklisted and the time that funds are burned, so there should be mechanisms set in place to prevent blacklisted users from taking actions such as transferring funds (since blacklisted users can still run the `transfer()` function).

As defined in current BurnContract.sol, there is a duplicated Solidity pragma declaration that may affect to compiler usage restrictions. ```solidity pragma solidity 0.6.6; ... pragma solidity >=0.5.0; ```` Although the compiler in its first defined version (0.6.6) will process the source code without problems and compile it generating the associated byte code, it is advisable to define a single version of solc in the headers of the source files to avoid any misconfiguration during software development lifecycle.

It was noted that the `transferFrom()` function in `PanaromaToken.sol` is only available when the contract is unpaused. ```solidity=411 function transferFrom(address from, address to, uint value) public whenNotPaused { ``` However, the same treatment is not applied to the `transfer()` function. ```solidity=379 function transfer(address to, uint256 value) public returns (bool) { ``` Token transfers should be disabled when the contract is paused.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=48 IERC20(_tokenContract).transfer(owner, IERC20(_tokenContract).balanceOf(address(this))); ```

These functions were not implemented within the scope of the contract for this audit. ```solidity=333 function transferByLegacy(address from, address to, uint value) public; ``` ```solidity=334 function transferFromByLegacy(address sender, address from, address spender, uint value) public; ```

Following imports declared in BurnContract.sol are not in use in the program. The references made to SafeMath library during the declaration at `using SafeMath for uint256` are not truly effective since no math operations are involved in any of the existing methods `withdraw()` nor `withdrawTokens()`. Imports that should be removed from the codebase: ```solidity import "./TransferHelper.sol"; import "./SafeMath.sol"; ```

In contract `BurnContract` there are several libraries that are declared but never used in the contract. The library `SafeMath` is declared on a using-for directive in `BurnContract` but its functionalities are never used. ```solidity=29 using SafeMath for uint256; ``` The library `TransferHelper` is declared but never used in the `BurnContract` ```solidity=42 msg.sender.transfer(address(this).balance); ``` ```solidity=46 IERC20(_tokenContract).transfer(owner, IERC20(_tokenContract).balanceOf(address(this))); ```

The function `payBurnFrom()` is declared but never used in the contract.