Kuku - Audit

The current audit scope pertains to the contract deployed on the Ethereum mainnet, however it was noted that it seems like there are several other chains that this contract has already been deployed or will be deployed in the future.

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by backrunning (executing after the target) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `internalSwap()` ```solidity try swapRouter.swapExactTokensForETHSupportingFeeOnTransferTokens( contractTokenBalance, 0, // @audit sandwich attacks path, address(this), block.timestamp ) {} catch { return; } ``` Additionally, the attackers may take advantage of the flashloan and perform the following steps for an attack: 1. Flash loan a great number of KUKU tokens and swap it to ETH via the `swapRouter` 2. Trigger the `internalSwap` while transferring the token. 3. Swap back ETH for KUKU coin. 4. Repay the flashloan and gain KUKU coin as profit.

The linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=180 IRouter02 public swapRouter; ``` - The contract `KuKu` interacts with third party contract with `IRouter02` interface via `swapRouter`.

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.