Audit Report
Paladin reviewed IFOSwap (Audit Report) on 9 Aug 2021: 29 findings, 0 critical; 7 marked fixed, 19 acknowledged, 3 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings29
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 1 | 3 |
| Medium | 1 | 5 | 2 |
| Low | 1 | 13 | 2 |
HighUser allocation is only precise up to 1/1000000Acknowledged
The report gives no description here.
MediumemergencyWithdraw function is vulnerable to reentrancyAcknowledged
The report gives no description here.
MediumemergencyWithdraw function is vulnerable to reentrancyAcknowledged
The report gives no description here.
MediumRewards can be stopped by owner at any timeAcknowledged
The report gives no description here.
MediumSeverely excessive rewards issue when a token with a transfer tax is addedAcknowledged
The report gives no description here.
MediumWithdrawing not possible in certain scenariosAcknowledged
The report gives no description here.
LowConstructor does not have parameter safeguardsAcknowledged
The report gives no description here.
LowdelegateBySig can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
Lowdeposit, and withdraw, emergencyWithdraw, add, and set can be made externalAcknowledged
The report gives no description here.
Lowdev function can be renamed, made external, and only be called by the owner of the contractAcknowledged
The report gives no description here.
Show 9 more
LowemergencyRewardWithdraw, emergencyWithdraw, withdraw and deposit can be made external.Acknowledged
The report gives no description here.
LowenterStaking and leaveStaking are redundantAcknowledged
The report gives no description here.
LowLack of events for add, set, setDevAddress and updateMultiplierAcknowledged
The report gives no description here.
LowLack of events for emergencyRewardWithdraw and stopRewardsAcknowledged
The report gives no description here.
LowLack of events for setOfferingAmount, setRaisingAmount, updateStartAndEndBlocks, approve, _endFarmStaking, finalWithdrawLPToken and finalWithdrawOfferingTokenAcknowledged
The report gives no description here.
LowlpToken, offeringToken, masterchef, pid and farmRewardToken can be made immutableAcknowledged
The report gives no description here.
Lowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to the MasterchefAcknowledged
The report gives no description here.
LowPools use the contract balance to figure out the total depositsAcknowledged
The report gives no description here.
LowThe IFO contract might stake in an insecure masterchefAcknowledged
The report gives no description here.
Contracts in scope5
| Address | Chain | Source code |
|---|---|---|
| 0xb9dbe638956a812650eb384958111b85b332aa24 | Chain: BNB Chain | Source code: Verified source |
| 0x97641c20355571820f591839d972ad2d38ad9f00 | Chain: BNB Chain | |
| 0xdcec0b7fcf2b842d56debb89521558be2475665f | Chain: BNB Chain | Source code: Verified source |
| 0xae75ca6f4b11c91df5339220f4db7d6f467751ed | Chain: BNB Chain | Source code: Verified source |
| 0xcf701a6809e30cf615eb0b446d62091a3bf0cf0f | Chain: BNB Chain | Source code: Verified source |
Part of IFOSwap’s security record
IFOSwapSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us