Quote from: rexilion on October 06, 2017, 06:38:55 PM

Quote from: Rumipl on October 06, 2017, 06:22:22 PM

Quote from: Opurum on October 06, 2017, 05:41:13 PM

I did ask a question which is yet to get a response from the Admin of Smartbillions: Does the fact that it was stated in the contract that Admin can make withrawals for payouts and redemptions give any form of legitimacy to the withdrawals made by Admin at the hack of the Hackathon?

The funds from the first Hackathon were withdrawn by the Admin using the coldStore function.
The withdraw was possible because there werent any liabilities on the contract such as Token redeem and win payouts. There werent any wins to pay out because the players were able to claim the wins after a given time period, they werent the lottery winners right after the lottery draw. At the moment of the Admin withdraw there were no wins to pay.

After the ICO ends but before the first lottery, there will be also no wins to pay so what will prevent the admins from withdraw all the ICO money??

Please link to exact contract method that will prevent this.

The funds raised during an ICO are protected within the smart contract.
Withdrawals by the admin are possible in the coldStore function.

function coldStore(uint _amount) external onlyOwner
{
houseKeeping();
require(_amount > 0 && this.balance >= (investBalance * 9 / 10) + walletBalance + _amount);
if(investBalance >= investBalanceGot / 2){ // additional jackpot protection
require((_amount <= this.balance / 400) && coldStoreLast + 4 60 24 * 7 <= block.number);
}
msg.sender.transfer(_amount);
coldStoreLast = block.number;
}

This line:
require(_amount > 0 && this.balance >= (investBalance * 9 / 10) + walletBalance + _amount);

guaranties that the admin can never withdraw more funds than: the 90% of the funds invested during the ICO plus the funds in wallets waiting to be withdrawn (these includes unpaid prizes due to lack of funds in the contract; however these prizes must have been claimed with the won() function before, otherwise the prizes are not known to the contract).

There is also an additional important limit that the withdraw amount must be smaller than 0.25% of the jackpot and this fraction can not be withdrawn more often than every 7 days (4*60*24*7 blocks).

This additional limit is waived if 50% of investors decide to disinvest.

This additional limit means that if there is a large lottery win waiting but the winner did not collect the results yet, then the admin can run away with 0.25% of the current jackpot , leaving 99.75% of the jackpot still in the contract. Thus this risk has a negligible effect on the collected funds by the winner. The regular withdraw of 0.25% per week by the admin to promote the lottery is an expected behavior.