Gigaswap - Audit

In the contract `Farming` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `FeeSettings` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `FeeSettingsWriter` the role `_factory` has authority over the functions shown in the diagram below. Any compromise to the `_factory` account may allow the hacker to take advantage of this authority.  In the contract `FeeSettingsWriter` the role `factory` has authority over the functions shown in the diagram below. Any compromise to the `factory` account may allow the hacker to take advantage of this authority.  In the contract `Erc20Sale` the role `antibot` has authority over the functions shown in the diagram below. Any compromise to the `antibot` account may allow the hacker to take advantage of this authority.  In the contract `Erc20SaleWeth` the role `antibot` has authority over the functions shown in the diagram below. Any compromise to the `antibot` account may allow the hacker to take advantage of this authority.  In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `TradableErc20` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `TradableErc20` the role `_withdrawAddress` has authority over the functions shown in the diagram below. Any compromise to the `_withdrawAddress` account may allow the hacker to take advantage of this authority.  In the contract `TradableErc20` the role `_withdrawer` has authority over the functions shown in the diagram below. Any compromise to the `_withdrawer` account may allow the hacker to take advantage of this authority.  In the contract `Withdrawable` the role `_withdrawAddress` has authority over the functions shown in the diagram below. Any compromise to the `_withdrawAddress` account may allow the hacker to take advantage of this authority.  In the contract `Withdrawable` the role `_withdrawer` has authority over the functions shown in the diagram below. Any compromise to the `_withdrawer` account may allow the hacker to take advantage of this authority.  In the contract `Erc20ForFactory` the role `_factory` has authority over the functions shown in the diagram below. Any compromise to the `_factory` account may allow the hacker to take advantage of this authority.  In the contract `Erc20ForFactory` the role `factory` has authority over the functions shown in the diagram below. Any compromise to the `factory` account may allow the hacker to take advantage

It is expected that calls of the form `allowance(owner, spender)` return the allowance that address `spender` has over tokens held by address `owner`. However, the implementation of `allowance` in contract `gWETH` returns different values when the `_withoutAllowance[spender]` is `true`. The owner address has the privilege to assign as many addresses as possible to have a max allowance returned no matter what the owner address is.

In the contracts `Erc20Sale` and `Erc20SaleWeth`, we noticed that there is an input address called `antibot` in the `buy()` functions. The `antibot` address is used to check if the `msg.sender` is equal to the `antibot` address. From the naming of `antibot` we guess the purpose is to not allow smart contracts to call the address? If so, the current implementation of `require(msg.sender == antibot, 'antibot')` will not help.

The Gigaswap contract lacks comments, natspec, or documentation explaining the specific use case of each function.

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. The `feePercentFor()` and `feeEthFor()` function relies on the balance of gigaToken that are based on-chain, meaning they are susceptible to flash-loan attacks by borrowing money to increase the account amount.