# DistrictOne audit Three Sigma · Social money games · 13th June 2024 A private security review of DistrictOne (social money games), conducted with Three Sigma and completed on 13th June 2024 over 6 days. 0xSimao disclosed 10 findings: 2 high severity, 3 medium and 5 informational. ## What DistrictOne is DistrictOne merges money games with social interaction on Blast: LinkUp networking rewards, SpaceSprint competitions, DailyRally gem lotteries, SpaceShare investing in a space's success, all moving real balances that the contracts settle, with meme-token fair launches on the side. ## Scope The review treated each game as a small exchange: overfunding and refund paths in the fair launcher, signature validation on issuer addresses, share-specified participation, invite-fee accounting in storage, and the Blast yield that accrues to whichever contract holds the ETH. ## High severity findings - [Claiming will fail for Ole and D1MemeToken if the overfunded ETH reverts](https://0xsimao.com/findings/districtone-meme-overfunded-eth-reverts) - [Any signature is valid before the issuer address is set](https://0xsimao.com/findings/districtone-signature-valid-issuer-address) ## Medium severity findings - [FairLauncher::newFairLaunch() may be misconfigured](https://0xsimao.com/findings/districtone-fair-launcher-launch-misconfigured) - [FairLauncher::participate() should allow specifying a minimum number of shares due to the overfund mechanism](https://0xsimao.com/findings/districtone-participate-specifying-shares-overfund) - [FairLauncher inherits BlastNoYieldAdapter but will hold ETH](https://0xsimao.com/findings/districtone-inherits-blast-yield-eth) ## Informational findings - [Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case](https://0xsimao.com/findings/districtone-erc20-utils-transfer-transferred) - [Deadline in Ole swap could be sent as a parameter to further prevent MEV](https://0xsimao.com/findings/districtone-deadline-ole-further-mev) - [Invite fees in FairLauncher::_calInviteFees() may be 0, in which case storage update could be skipped](https://0xsimao.com/findings/districtone-invite-fees-cal-storage) - [D1MemeTokens will be stuck whenever the merkle roots or the free claims are not fully claimed](https://0xsimao.com/findings/districtone-stuck-merkle-roots-claimed) - [TokenVault allows withdrawals using offchain logic, so the offchain service must take into consideration reorgs](https://0xsimao.com/findings/districtone-withdrawals-offchain-consideration-reorgs) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-06-13-districtone.pdf)