PEAKDEFI

As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.

`changeTokenData` must not allow to change the decimals value, many third party platform rely on the token decimals value to do sensitive calculation, changing the decimals value will lead to high severity issues.

Multiple functions in `PeakDeFiLogic3` loop through `cycleNumber`. Depending on the current cycle value the gas consumption can be excessively high with a low risk to reach block gas limit.

If a contract is used to register as a manager using `registerWithETH` or `registerWithToken`, the contract might end by receiving USDC back if the sent balance to register is higher than the maximum allowed. This can be an issue if the contract does not handle USDC correctly.

Functions should always validate input parameters before using their values. One common mistake that could occur due to missing input validation is that funds are sent to the `0x0` address. Parameters input in the functions listed below are not validated: - `CompoundOrderFactory.constructor()`. - `PeakReward.constructor()`. - `PeakStaking.constructor()` . - `PeakStaking.init()`. - `PeakDeFiFund.initParams()`. - `PeakDeFiFactory.constructor()`. - `PeakDeFiV1.initialize()`. - `PeakSwap.constructor()`.

When users interact with their installed wallet to sign an unstructured message they only see an unreadable bytestring, therefore no useful indication is displayed to allow avoiding phishing attempts or possible replay attacks (when interacting with different EVM capable blockchains). Affected functions: - `PeakDefiFund.createInvestmentWithSignature ()` - `PeakDefiFund.sellInvestmentWithSignature()` - `PeakDefiFund.createCompoundOrderWithSignature()` - `PeakDefiFund.sellCompoundOrderWithSignature()` - `PeakDefiFund.repayCompoundOrderWithSignature()`

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In`PeakDefiLogic2.peakAdminRegisterManager` owner can add manager without any initial donation, Please note that the function is not accessible through `PeakDefiFund`. However, it can be deployed in future upgrades .

`UniswapOracle.update` is allowed to be called only once every 24 hrs. Using uniswap as oracle represents some risks since if the cumulative price window is too short the `UniswapOracle.consult` return value can be subject to manipulation. However, higher values of `period` can lead the prices to not be reflected in time and negatively impact on the system.

When getting the price average for a token using `UniswapOracle.consult` the price might be stale, meaning that if the oracle stops being updated, the contract calling `UniswapOracle.consult` won't be notified.