TinyBlock

0x103d077625e00380e67ea543ae243958f39c4b6e:TinyIDO.withdrawNative(address,uint256) {TinyIDO.sol#57-59} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyIDO.sol#58}
Modifiers: onlyOwner
TinyIDO.commit(uint256,uint256,address,uint256,uint256,uint256,uint256,uint256,bytes) {TinyIDO.sol#65-100} has backdoor transfer function that is able to drain all funds in the contract:
- address(TREASURY).transfer(_amount) {TinyIDO.sol#94}
Modifiers: nonReentrant,whenNotPaused
However, since the contract is not stake-able, the risk is lowered.
0x3d40f683d7abc7380c164d0bcb960c96745ec62c:TinyVesting.withdrawNative(address,uint256) {TinyVesting.sol#134-137} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyVesting.sol#136}
Modifiers: onlyOwner
However, the following expressions might block the token from being drained:
- require(bool,string)(_to != address(0),_to is zero address) prevents token unknown (ref: 0) [balance: N/A] to be drained.
TinyVesting.partialRefund(uint256,uint256,address,uint256,uint256,uint256,bytes) {TinyVesting.sol#192-230} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#223}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#226}
Modifiers: nonReentrant
TinyVesting.refund(uint256,uint256,address,uint256,uint256,uint256,bytes) {TinyVesting.sol#232-270} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#263}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#266}
Modifiers: nonReentrant
TinyVesting.crf(uint256,uint256,address,uint256,uint256,bytes) {TinyVesting.sol#272-305} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#298}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#301}
Modifiers: nonReentrant
TinyVesting.bonus(uint256,uint256,address,uint256,uint256,bytes) {TinyVesting.sol#308-342} has backdoor transfer function that is able to drain all funds in the contract:
- address(msg.sender).transfer(_amount) {TinyVesting.sol#335}
- IERC20(_token).safeTransfer(msg.sender,_amount) {TinyVesting.sol#338}
Modifiers: nonReentrant
However, since the contract is not stake-able, the risk is lowered.
0x734c8aeb813aad647215dcd577f3a02b6aad88f6:TinyIDO.withdrawNative(address,uint256) {TinyIDO.sol#57-59} has backdoor transfer function that is able to drain all funds in the contract:
- address(_to).transfer(_amount) {TinyIDO.sol#58}
Modifiers: onlyOwner
TinyIDO.commit(uint256,uint256,address,uint256,uint256,uint256,uint256,uint256,bytes) {TinyIDO.sol#65-100} has backdoor transfer function that is able to drain all funds in the contract:
- address(TREASURY).transfer(_amount) {TinyIDO.sol#94}
Modifiers: nonReentrant,whenNotPaused
However, since the contract is not stake-able, the risk is lowered.