Security Audit Report

An attacker calls initialize() directly on the AccountManager or ClaimManager implementation contract (possible because no constructor calls _disableInitializers()). This grants the attacker the Admin role on the implementation. The attacker then calls upgradeToAndCall() on the implementation, pointing it to a malicious contract. Because all proxies delegatecall to the implementation and _authorizeUpgrade only checks the Admin role, the attacker gains full control over the proxy storage and all user funds managed by those contracts.

MigrationManager.migratePurchasedNFTs validates payment AFTER calling _migrateNFTs. If discountFactor is 0 (possible if the admin has not yet configured it or it is reset), the required payment computes to 0 via integer multiplication. An attacker calls migratePurchasedNFTs with msg.value=0, _migrateNFTs burns old NFTs and mints new ones, and the payment check passes because 0 == 0. The attacker obtains new NFTs for free. This is compounded by the 10e12 vs 1e12 calculation error which already makes migrations 10x cheaper than intended.

SnuggeryManager.pet multiplies schnibble amounts by 1e18 after already using a PET_TOTAL_SCHNIBBLES config value that is expressed at 1e18 scale. This produces schnibble grants 1e18 times larger than intended. These inflated schnibbles can be fed to NFTs via SnuggeryManager.feed, causing NFT chonk values to skyrocket. The corrupted globalTotalChonk tracked in _recalculateChonks then causes ClaimManager to distribute points using a denominator that no longer reflects real aggregate state, allowing early users to claim a disproportionate share of all available points.

LockManager.unlock calls accountManager.forceHarvest before decrementing lockedToken.quantity. forceHarvest reads the full pre-decrement locked balance via lockManager.getLockedWeightedValue to compute schnibbles. A user repeatedly calling unlock in small increments each time harvests schnibbles as if they still hold their full balance, systematically over-accumulating schnibbles beyond their rightful share. These excess schnibbles can then be converted to chonks and fed into the claims system.