NAOS-Formation Updates

The call `uniV2Router.swapExactTokensForTokens(alpacaToken.balanceOf(address(this)), 0, path, address(this), block.timestamp + 800);` sets the `amountOutMin` value to 0. If the pool is out-of-balance or manipulated in an unfavorable way (possibly through a [sandwich-attack](https://medium.com/coinmonks/defi-sandwich-attack-explain-776f6f43b2fd)), the swap may result in very few `bUSD` tokens being withdrawn.

The related [TransmuterB.sol](https://github.com/alchemix-finance/alchemix-protocol/blob/master/contracts/TransmuterB.sol) contract utilizes an `ensureUserActionDelay` modifier, as implemented [here](https://github.com/alchemix-finance/alchemix-protocol/blob/14344a0386351b374da061122e1f5caf8e421afc/contracts/TransmuterB.sol#L330). This guards functions `stake`, `transmute`, and `forceTransmute`, and may mitigate unforeseen attacks such as flash loan attacks.

The following functions have return values that are not checked: 1. AlpacaVaultAdapter.withdraw(address,uint256) (contracts/adapters/AlpacaVaultAdapter.sol#124-133) ignores return value by busdToken.transfer(_recipient,busdToken.balanceOf(address(this))) (contracts/adapters/AlpacaVaultAdapter.sol#132) 1. AlpacaVaultAdapter.indirectWithdraw(address,uint256) (contracts/adapters/AlpacaVaultAdapter.sol#141-161) ignores return value by busdToken.transfer(_recipient,busdToken.balanceOf(address(this))) (contracts/adapters/AlpacaVaultAdapter.sol#160) 1. Formation._distributeToTransmuter(uint256) (contracts/Formation.sol#593-598) ignores return value by token.approve(transmuter,amount) (contracts/Formation.sol#594) 1. FormationV2._distributeToTransmuter(uint256) (contracts/FormationV2.sol#600-605) ignores return value by token.approve(transmuter,amount) (contracts/FormationV2.sol#601) 1. TransmuterV2._plantOrRecallExcessFunds() (contracts/TransmuterV2.sol#687-702) ignores return value by _activeVault.deposit(plantAmt) (contracts/TransmuterV2.sol#695) 1. TransmuterV2.migrateFunds(address) (contracts/TransmuterV2.sol#797-807) ignores return value by IERC20Burnable(Token).approve(migrateTo,migratableFunds) (contracts/TransmuterV2.sol#804) 1. AlpacaVaultAdapter.indirectWithdraw(address,uint256) (contracts/adapters/AlpacaVaultAdapter.sol#141-161) ignores return value by uniV2Router.swapExactTokensForTokens(alpacaToken.balanceOf(address(this)),0,path,address(this),block.timestamp + 800) (contracts/adapters/AlpacaVaultAdapter.sol#151-157) 1. YearnVaultAdapter.deposit(uint256) (contracts/adapters/YearnVaultAdapter.sol#63-65) ignores return value by vault.deposit(_amount) (contracts/adapters/YearnVaultAdapter.sol#64) 1. YearnVaultAdapter.withdraw(address,uint256) (contracts/adapters/YearnVaultAdapter.sol#73-75) ignores return value by vault.withdraw(_tokensToShares(_amount),_recipient) (contracts/adapters/YearnVaultAdapter.sol#74)

Every Solidity file specifies in the header a version number of the format `pragma solidity (^)0.4.*`. The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".