Flokifi II

The `createVaultWithoutKey()` function can be called by someone in the whitelist to create a vault, but does not mint nft, so `IVault(vault).vaultKeyId()` always returns 0 when called within the function `createVaultWithoutKey`, and the variable `vaultByKey[keyId]` will be overwritten.

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=241 USDT.safeTransferFrom(user, address(this), usdtAmount); ``` - Transferring tokens by `usdtAmount`. ```solidity=263 uint256 treasuryUSDTShare = usdtAmount - referrerUSDTShare - burnShare; ``` - The `usdtAmount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

The `_hasDiscount` function is called to check if it owns a certain nft that can be discounted, so there may be some sort of nft supported by this contract that can be used for borrowing, and therefore the user can be exempted from the charge by borrowing the nft.

The function `isV2LiquidityPoolToken()` is designed to check if the passed-in address token is an uniswap v2 pair, the function's checking is lax, and a malicious user can build a contract to pass the check, as is the case with the `isV3LiquidityPoolToken` function.

The `removeTokensFromSwappingByIndexes()` function is called to remove the addresses of the tokens at the specified locations. Since the removal is cyclic, it is possible that the incoming locations have already been removed and the function call will fail. ```solidity=141 address tokenAddress = _tokens[index].tokenAddress; _tokens[index] = _tokens[_tokens.length - 1]; _tokens.pop(); ```

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `router.removeLiquidity()` - `router.swapExactTokensForTokens()`

The `reinvestV3PositionFees()` can be called by the owner of the vault to collect the LP fee and transfer the fee tokens to the current vault, then this part of the token to increase liquidity. ```solidity IERC20(token0).safeApprove(address(tokenAddress), earnedToken0); IERC20(token1).safeApprove(address(tokenAddress), earnedToken1); INonfungiblePositionManager.IncreaseLiquidityParams memory params = INonfungiblePositionManager.IncreaseLiquidityParams({ tokenId: tokenId, amount0Desired: earnedToken0, amount1Desired: earnedToken1, amount0Min: amount0Min, amount1Min: amount1Min, deadline: block.timestamp }); INonfungiblePositionManager(tokenAddress).increaseLiquidity(params); ``` The function `increaseLiquidity()` returns the amount of tokens used to add liquidity, and the parameter `earnedToken` may not necessarily be equal. As a result, there is a possibility that some tokens will remain in the contract. If these tokens are not present in `fungibleTokenDeposits`, then this portion of tokens will be locked in the contract.

The function `_processNfts` is called to remove liquidity and collect fees and then transfer the asset to the `lpTokenProcessor` for processing. The token accepted by the `lpTokenProcessor` should be equal to the difference between before and after the transfer. ```solidity=161 IERC20(price.v3LpTokens[i].token0).safeTransfer(address(lpTokenProcessor), balance0); IERC20(price.v3LpTokens[i].token1).safeTransfer(address(lpTokenProcessor), balance1); uint256 amount0Received = initialToken0Balance - IERC20(price.v3LpTokens[i].token0).balanceOf(address(this)); uint256 amount1Received = initialToken1Balance - IERC20(price.v3LpTokens[i].token1).balanceOf(address(this)); ```

The smart contract contains one or more values that are not used, which can lead to unnecessary complexity and reduced maintainability. ```solidity=105 uint256 referrerLPShare = 0; ``` - The variable `referrerLPShare` is never used after this assignment. --- ```solidity=107 referrerLPShare = (price.v2LpAmounts[i] * referrerBasisPoints) / 10000; ``` - The variable `referrerLPShare` is never used after this assignment. --- ```solidity=226 uint256 usdBalance = usdtAmount; ``` - The variable `usdBalance` is never used after this assignment. --- ```solidity=211 try discountNFTs[i].tokenOfOwnerByIndex(user, 0) returns (uint256) { return true; } catch ( bytes memory /* lowLevelData */ ) {} ``` - The variable `` is never used after this assignment.