Magus

Smart Contract Audit Report

Audit Summary

Magus Audit Report Magus is a new BEP20 token platform where users can exchange their tokens for nodes and earn rewards.

For this audit, we reviewed the project team's magus and magusPresale contracts at commit 3c15baa892fce3d6cd01983194915f11204076cb on the team's GitHub repository.

Audit Findings

Please ensure trust in the team prior to investing as they have substantial control in the ecosystem.
Date: May 13th, 2022.
Updated: May 17th, 2022 to resolve findings #1, #2, #3, #4, #6, #7, and #8.

Finding #1 - magus - High (Resolved)

Description: The function claimTokenAndNode() does not correctly update a user's balance of $MagusPre or claim status after they redeem their tokens.
Risk/Impact: Users can repeatedly redeem their MagusPre tokens for Magus tokens.
Recommendation: The team should modify the claimTokenAndNode() function to update the msg.sender's balance of MagusPre and claim status such that they cannot repeatedly redeem the same tokens.
Resolution: The team has modified the function to check and update the user's claim status.

Finding #2 - magus - High (Resolved)

Description: claimTokenAndNode() increases user's balances without subtracting tokens from any source.
Risk/Impact: The event emitted is not accurate and as a result any tokenomics associated with this contract will be incorrect. Additionally, the total supply of tokens is not enforced.
Recommendation: The team should subtract the amount being added to msg.sender's balance from the owner's wallet and modify the event to correctly record the transfer's sender as the contract owner.
Resolution: The team has allotted a portion of the total supply to the contract to be distributed in exchange for $MagusPre tokens.

Finding #3 - magus/magusPresale - High (Resolved)

Description: The contracts do not properly emit events whenever the token balance of an address is modified.
Risk/Impact: Any tokenomics associated with the contracts will be incorrect.
Recommendation: The team should modify the contracts to emit accurate events whenever the balance of an address is modified.
Resolution: The team has implemented events in the appropriate places.

Finding #4 - magus - High (Resolved)

Description: Several addresses referenced as contracts, while correct on the Binance Mainnet, are wallets on the Cronos Mainnet:
The USDC address 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56 referenced in the magus contract,
the UniswapV2Router address 0x10ED43C718714eb63d5aA57B78B54704E256024E referenced in the magus contract.
Risk/Impact: Function calls on these addresses will fail.
Recommendation: The team should correct these addresses.
Resolution: The team has corrected the UniswapV2Router the USDC addresses to Cronos addresses.

Finding #5 - magus - Medium

Description: The function claimTokenAndNode() performs multiplication on the result of a division.
uint256 bal = MagusPre.balanceOf(msg.sender);
bal = bal.div(100);
uint256 nodeToGive = bal.div(2);
bal = bal.sub(nodeToGive);
...
_balances[msg.sender] = _balances[msg.sender].add(bal.mul(100));
Risk/Impact: Division can lead to integer truncation, therefore dividing and subsequently multiplying can cause results to lose precision and become less accurate. As a result, users cannot claim any number of MagusPre tokens they own under 100.
Recommendation: The team should modify the function to perform all multiplication before division.
Resolution: The team has not yet addressed this issue.

Finding #6 - magusPresale - Low (Resolved)

Description: The require statement inside the fund() function does not account for the amount a user is currently trying to contribute when checking if they are exceeding their maximum contribution.
require(contAMT[msg.sender]<=1000*10**uint256(_decimals),"can't contribute more than $1000");
Risk/Impact: The maximum contribution amount can be exceeded.
Recommendation: The team should account for the amount being contributed at the time of transaction when enforcing the maximum contribution amount.
Resolution: The team has concluded their use of the magusPresale contract.

Finding #7 - magus - Low (Resolved)

Description: The makeClaimNodeReward() function incorrectly subtracts when it should be assigning. The same error appears in the makeRewardClaim() function. This appears to be a minor typo of "-" instead of "=".
_interest[claimer] -_interest[claimer].add(roi);
...
_interest[seller] -_interest[seller].add(roi);
Risk/Impact: The interested associated with the claimer's address is not updated properly.
Recommendation: The team should correct this typo.
Resolution: The team has corrected the line.

Finding #8 - magus - Informational (Resolved)

Description: maxAMTperSell is never used.
Recommendation: This variable can be removed for additional gas savings.
Resolution: The team has removed the variable.

Finding #9 - magus/magusPresale - Informational

Description: The _burnFrom() functions are never used.
Recommendation: These functions can be removed for additional gas savings.
Resolution: The team has not yet addressed this issue.

Contracts Overview

  • As the contracts are implemented with Solidity v0.8.0, they are safe from any possible overflows/underflows.
Magus Contract:
  • This contract is used to redeem $MagusPre tokens for $TMN tokens and to trade $TMN tokens for nodes.
  • When users redeem their $MagusPre tokens, half are redeemed as $TMN tokens and the remaining half are redeemed in the form of nodes.
  • One node is equivalent to 100 $TMN tokens; users can buy nodes using their $TMN tokens at any time.
  • There are 100,000 nodes avaialable for purchase from the contract on deployment.
  • Half of the $TMN tokens paid when buying nodes is added to the rewards pool, the remaining half is added to the dev wallet.
  • Users can claim rewards earned for owning nodes once per day; users automatically claim rewards when they buy nodes.
  • Rewards are paid in $TMN tokens equal to the number of nodes a user owns from the reward pool.
  • There is a rewards fee takes on all rewards:
    • 10% of the rewards fee is added to the dev wallet.
    • 10% of the rewards fee is added to the treasury wallet.
    • The remaining 80% of the rewards fee is added back in to the rewards pool.
  • There is a 1% transfer fee taken on all transfers:
    • 50% of the transfer fee is added to the dev wallet.
    • The remaining 50% of the transfer fee is added to the rewards pool.
  • If a transfer takes places within 10 days of the contract's deployment, there is an additional 2% added to the fee for every day left until 10 days have passed.
  • The contract enforces a maximum transaction amount which is set to zero on deployment.
  • During a transfer, the $TMN stored in the dev wallet is swapped for $USD tokens and sent to the owner when the following conditions are met:
    • The threshold number of tokens in the wallet has been reached.
    • The transfer is not a buying transaction via Uniswap.
    • The contract is not currently performing a swap.
  • Users can burn any amount of their own tokens at any time.

  • The Owner can update the $TMN to $USD conversion threshold to any value at any time.
  • The Owner can update the $MagusPre address to any address at any time.
  • The Owner can include or remove any address from transfer fees at any time; reward fees are always collected.
  • The Owner can include or remove any address from the blacklist at any time; blacklisted users are excluded from token transfers.
  • The Owner can update the maximum transaction amount to any value at any time.
  • The Owner can update the P2P contract address to any address at any time.
magusPresale Contract:
  • This contract faciliatates the sale of $MagusPre tokens.
  • Whitelisted users can purchase $MagusPre tokens that can then be converted to $TMN tokens using the Magus contract.
  • The contract enforces a minimum purchase of 200 $USDC and a maximum of 1000 $USDC per transaction.
  • The Owner can add any address to the whitelist at any time.

Audit Results

Vulnerability CategoryNotesResult
Arbitrary Jump/Storage WriteN/APASS
Centralization of ControlN/APASS
Compiler IssuesN/APASS
Delegate Call to Untrusted ContractN/APASS
Dependence on Predictable VariablesN/APASS
Ether/Token TheftN/APASS
Flash LoansN/APASS
Front RunningN/APASS
Improper EventsN/APASS
Improper Authorization SchemeN/APASS
Integer Over/UnderflowN/APASS
Logical IssuesN/APASS
Oracle IssuesN/APASS
Outdated Compiler VersionN/APASS
Race ConditionsN/APASS
ReentrancyN/APASS
Signature IssuesN/APASS
Unbounded LoopsN/APASS
Unused CodeThe _burnFrom() functions are never used.PASS
Overall Contract Safety PASS

Magus Contract

Smart Contract Audit - Inheritance

Smart Contract Audit - Graph


 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
 + [Int] IUniswapV2Factory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

 + [Int] IUniswapV2Pair 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #
    - [Ext] MINIMUM_LIQUIDITY
    - [Ext] factory
    - [Ext] token0
    - [Ext] token1
    - [Ext] getReserves
    - [Ext] price0CumulativeLast
    - [Ext] price1CumulativeLast
    - [Ext] kLast
    - [Ext] mint #
    - [Ext] burn #
    - [Ext] swap #
    - [Ext] skim #
    - [Ext] sync #
    - [Ext] initialize #

 + [Int] IUniswapV2Router01 
    - [Ext] factory
    - [Ext] WETH
    - [Ext] addLiquidity #
    - [Ext] addLiquidityETH ($)
    - [Ext] removeLiquidity #
    - [Ext] removeLiquidityETH #
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)
    - [Ext] quote
    - [Ext] getAmountOut
    - [Ext] getAmountIn
    - [Ext] getAmountsOut
    - [Ext] getAmountsIn

 + [Int] IUniswapV2Router02 (IUniswapV2Router01)
    - [Ext] removeLiquidityETHSupportingFeeOnTransferTokens #
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #

 + [Int] nodeMethods 
    - [Ext] makeRewardClaimP2P #
    - [Ext] confirmSaleOnP2P #

 +  magus (Context, IBEP20, Ownable, ReentrancyGuard, nodeMethods)
    - [Pub]  #
       - modifiers: ReentrancyGuard
    - [Ext] getOwner
    - [Ext] decimals
    - [Ext] symbol
    - [Ext] name
    - [Ext] totalSupply
    - [Ext] total_burnt
    - [Pub] balanceOf
    - [Pub] totalburnt
    - [Ext] isExcludedfromFee
    - [Ext] checkBlackList
    - [Ext] airdropNode #
       - modifiers: onlyOwner
    - [Ext] claimTokenAndNode #
    - [Ext] setThreshHold #
       - modifiers: onlyOwner
    - [Ext] manualburn #
    - [Ext] updatePresaleAddress #
       - modifiers: onlyOwner
    - [Ext] removeFromFee #
       - modifiers: onlyOwner
    - [Ext] includeInFee #
       - modifiers: onlyOwner
    - [Ext] setMaxTx #
       - modifiers: onlyOwner
    - [Ext] changeMinAmount #
       - modifiers: onlyOwner
    - [Ext] changeMaxAMTforSale #
       - modifiers: onlyOwner
    - [Ext] addToBlacklist #
       - modifiers: onlyOwner
    - [Ext] removeFromBlackList #
       - modifiers: onlyOwner
    - [Ext] setP2Paddress #
       - modifiers: onlyOwner
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Ext]  ($)
    - [Int] _transfer #
    - [Int] swapMagusForUSDC #
    - [Ext] makeClaimNodeReward #
       - modifiers: nonReentrant
    - [Ext] buyNode #
    - [Ext] makeRewardClaimP2P #
    - [Ext] confirmSaleOnP2P #
    - [Ext] pricePerToken
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _burnFrom #

magusPresale Contract

Smart Contract Audit - Inheritance

Smart Contract Audit - Graph


 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
 + [Int] IBEP20 
    - [Ext] totalSupply
    - [Ext] decimals
    - [Ext] symbol
    - [Ext] name
    - [Ext] getOwner
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 +  Context 
    - [Pub]  #
    - [Int] _msgSender
    - [Int] _msgData

 + [Lib] SafeMath 
    - [Int] add
    - [Int] sub
    - [Int] sub
    - [Int] mul
    - [Int] div
    - [Int] div
    - [Int] mod
    - [Int] mod

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Int] _transferOwnership #

 +  ReentrancyGuard 
    - [Pub]  #

 + [Lib] Address 
    - [Int] isContract
    - [Int] sendValue #
    - [Int] functionCall #
    - [Int] functionCall #
    - [Int] functionCallWithValue #
    - [Int] functionCallWithValue #
    - [Prv] _functionCallWithValue #

 +  magusPresale (Context, IBEP20, Ownable, ReentrancyGuard)
    - [Pub]  #
       - modifiers: ReentrancyGuard
    - [Pub] insertMagusAdd #
       - modifiers: onlyOwner
    - [Ext] addToWhiteList #
       - modifiers: onlyOwner
    - [Ext] getOwner
    - [Ext] decimals
    - [Ext] symbol
    - [Ext] name
    - [Ext] totalSupply
    - [Ext] total_burnt
    - [Pub] balanceOf
    - [Pub] totalburnt
    - [Pub] checkClaimed
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Int] _transfer #
    - [Ext] fund #
       - modifiers: nonReentrant
    - [Ext] changeHasClaimed #
       - modifiers: onlyOwner
    - [Ext] changeHasClaimedFromContract #
       - modifiers: onlyContract
    - [Int] _approve #
    - [Int] _burnFrom #

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

  • High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
  • Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
  • Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
  • Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.