diadata

The sensitive function `unpause` is public but has no access control modifier (e.g., onlyOwner, onlyRole) or inline msg.sender check. Anyone can call this function.

Add an access control modifier like `onlyOwner` or use OpenZeppelin's `AccessControl` to restrict who can call `unpause()`.

The sensitive function `unpause` is public but has no access control modifier (e.g., onlyOwner, onlyRole) or inline msg.sender check. Anyone can call this function.

Add an access control modifier like `onlyOwner` or use OpenZeppelin's `AccessControl` to restrict who can call `unpause()`.

The return value of `.send()` at line 1063 is not checked. Low-level calls return a boolean indicating success or failure, which must be verified.

Capture and check the return value: `(bool success, ) = addr.send(...); require(success, "Call failed");`

The return value of `.send()` at line 2010 is not checked. Low-level calls return a boolean indicating success or failure, which must be verified.

Capture and check the return value: `(bool success, ) = addr.send(...); require(success, "Call failed");`

Line 412 performs `-` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 634 performs `-` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 686 performs `-=` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 690 performs `+=` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 691 performs `+=` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 695 performs `-` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 796 performs `+` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 802 performs `+=` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 1049 performs `-` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 1053 performs `+` arithmetic in a Solidity <0.8.0 contract without SafeMath. This can silently overflow or underflow.

Use OpenZeppelin's SafeMath library for all arithmetic operations, or upgrade to Solidity >=0.8.0 which has built-in overflow checks.

Line 328 uses `balanceOf()` in an arithmetic expression, which may derive a spot price that is manipulable via flash loans.

Use TWAP or Chainlink oracles instead of spot balance calculations.

Function `giveBirth` contains external calls but lacks a `nonReentrant` modifier. While it may follow CEI, a guard provides defense-in-depth.

Add OpenZeppelin's `ReentrancyGuard` and apply `nonReentrant` to functions with external calls.

Function `withdrawBalance` contains external calls but lacks a `nonReentrant` modifier. While it may follow CEI, a guard provides defense-in-depth.

Add OpenZeppelin's `ReentrancyGuard` and apply `nonReentrant` to functions with external calls.

Function `withdrawBalance` contains external calls but lacks a `nonReentrant` modifier. While it may follow CEI, a guard provides defense-in-depth.

Add OpenZeppelin's `ReentrancyGuard` and apply `nonReentrant` to functions with external calls.

Function `bid` at line 1449 appears to perform a swap/trade operation but has no slippage protection (minAmountOut) or deadline parameter. This makes it highly vulnerable to sandwich attacks and MEV extraction.

Add a `minAmountOut` or equivalent slippage parameter and a `deadline` parameter. Validate both with require statements.

Function `bid` at line 1577 appears to perform a swap/trade operation but has no slippage protection (minAmountOut) or deadline parameter. This makes it highly vulnerable to sandwich attacks and MEV extraction.

Add a `minAmountOut` or equivalent slippage parameter and a `deadline` parameter. Validate both with require statements.

Function `bid` at line 1647 appears to perform a swap/trade operation but has no slippage protection (minAmountOut) or deadline parameter. This makes it highly vulnerable to sandwich attacks and MEV extraction.

Add a `minAmountOut` or equivalent slippage parameter and a `deadline` parameter. Validate both with require statements.

Function `bidOnSiringAuction` at line 1773 appears to perform a swap/trade operation but has no slippage protection (minAmountOut) or deadline parameter. This makes it highly vulnerable to sandwich attacks and MEV extraction.

Add a `minAmountOut` or equivalent slippage parameter and a `deadline` parameter. Validate both with require statements.

Contract `SiringClockAuction` is designed to receive Ether (it defines payable functions, `receive()`, or `fallback()`), but it has no visible function to withdraw or transfer Ether back out. Any Ether sent to this contract will be permanently locked and unrecoverable.

Implement a secure administrative withdrawal function (e.g. `withdraw()`) restricted to the contract owner/admin that transfers the contract's balance to an authorized address.

Contract `SaleClockAuction` is designed to receive Ether (it defines payable functions, `receive()`, or `fallback()`), but it has no visible function to withdraw or transfer Ether back out. Any Ether sent to this contract will be permanently locked and unrecoverable.

Implement a secure administrative withdrawal function (e.g. `withdraw()`) restricted to the contract owner/admin that transfers the contract's balance to an authorized address.

The Solidity version pragma `^0.4.11` is not locked to a specific compiler version. Different compiler versions may introduce different behavior, optimizations, or bugs.

Lock the pragma to a specific version, e.g., `pragma solidity 0.8.20;`. Use the latest stable version for new contracts.

The function `setCEO` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setCFO` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setCOO` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `pause` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `unpause` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setSecondsPerBlock` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setMetadataAddress` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setGeneScienceAddress` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `approveSiring` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

The function `setAutoBirthFee` is public/external and mutates state variables, but it does not emit any events. Emitting events is a standard security practice in Solidity to facilitate off-chain tracking, indexing, and security monitoring.

Define an event and emit it at the end of the state-changing operations in this function, passing relevant arguments (like old and new values).

Line 1253 uses `block.timestamp` inside an `if` condition. Since block.timestamp can be slightly manipulated by miners, using it in critical control structures carries a minor security risk.

Use block numbers for coarse time estimation if appropriate, or ensure the design accommodates a timestamp variance of up to 15 minutes.

Function or constructor `tokensOfOwner` accepts address parameter `_owner` but does not validate if it is the zero address (`address(0)`). Setting critical state variables or roles to the zero address by mistake can cause loss of ownership, permanently locked contracts, or unexpected resets.

Add a require statement or validation check: `require(_owner != address(0), "Invalid address");` at the beginning of the function.

Function or constructor `ClockAuction` accepts address parameter `_nftAddress` but does not validate if it is the zero address (`address(0)`). Setting critical state variables or roles to the zero address by mistake can cause loss of ownership, permanently locked contracts, or unexpected resets.

Add a require statement or validation check: `require(_nftAddress != address(0), "Invalid address");` at the beginning of the function.

Function or constructor `SiringClockAuction` accepts address parameter `_nftAddr` but does not validate if it is the zero address (`address(0)`). Setting critical state variables or roles to the zero address by mistake can cause loss of ownership, permanently locked contracts, or unexpected resets.

Add a require statement or validation check: `require(_nftAddr != address(0), "Invalid address");` at the beginning of the function.

Function or constructor `SaleClockAuction` accepts address parameter `_nftAddr` but does not validate if it is the zero address (`address(0)`). Setting critical state variables or roles to the zero address by mistake can cause loss of ownership, permanently locked contracts, or unexpected resets.

Add a require statement or validation check: `require(_nftAddr != address(0), "Invalid address");` at the beginning of the function.