AirLyft

This smart contract intends to be compatible with any ERC20 token, which includes the Fee-On-Transfer tokens  .An example would be the USDT contract which has the functionality in its contract but is currently disabled. If enabled, it would break functionality of the contract since the recorded totalLiquidity is now less than the actual token balance of the contract.This can be exploited in a scenario where a user USER A creates a pool to airdrop a popular token to multiple users. A malicious user USER B could create another pool with the same token, then run multiple deposits and withdrawals which will reduce the token balance of the contract address while maintaining the pool’s totalLiquidity. USER B then calls withdraw() to pull their funds from the contract while the token balance is now less than the totalLiquidity of USER A pool.

In the deposit() function of the contract. It permits ERC20 deposits to ERC20 pools, however since it is a payable function, users can in error pass in eth to the deposit call as an msg.value .Also the contract consists of a receive()and fallback()which allows eth to be sent directly to the contract. Any eth sent to the contract will be permanently stuck in the contract.

Not all tokens match the standard of returning false on failure, some tokens might not revert on failure, while some do not return any boolean. It is therefore advised to use the SafeERC20 library already imported from Open Zeppelin to handle transfers from the contract.

Usage of .transfer() instead of  .call() to send ether during withdrawals has its potential downsides especially when using this across multiple EVM chains as mentioned by the Client. Some chains might not support the opcode, something similar would be the Zksync bug involving 921 ETH .  Also there are potentials for break in smart contract functionality due to future upgrades in gas prices.

At multiple points within the repo, SafeMath is used to handle addition .add() and subtraction .sub(), however it is important to note that the solidity version used here being : pragma solidity 0.8.17; already handles overflow and underflow checks, hence it holds no functionality within this contract.