Gigaswap - Audit

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. File: TradingPairAlgorithm.sol ```solidity=519 positionsController.withdrawInternal(own, msg.sender, asset1Count); ``` File: EthAssetsController.sol ```solidity=54 function _withdraw( uint256 assetId, address recipient, uint256 count ) internal override { (bool sent, ) = payable(recipient).call{ value: count }(''); require(sent, 'sent ether error: ether is not sent'); } ```

The `addLiquidity()` function can be called by anyone to add liquidity to a pair. If there is a difference in precision between the two assets, the calculated amount of asset B may result in a value of 0. However, when calling the `withdraw()` function, users have the ability to withdraw asset B proportionally to the liquidity they provided. ```solidity=197 vars.countB = (count * assetB.count()) / assetA.count(); ``` For example:\ assetA[KISHU] : https://etherscan.io/address/0xa2b4c0af19cc16a6cfacce81f192b024d625817d \ assetB[USDC] : https://etherscan.io/address/0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48

In the library ItemRefAsAssetLibrary, there is a view function `getDecimals()` that returns different decimal numbers for different asset types. When the asset type is ERC20 token, the return value is hardcoded to be `9`, which will lead to compatibility issues if the decimal of the specific ERC20 token turns out to be other numbers.

There are functions that do not require modifying the contract state, nor do they need to receive Ether. However, these functions are not labeled with `view` modifiers. Here is the list of applicable functions: * PositionsController.positionsCount() * Vote.erc20Address() * Vote.userVote()

The function `withdraw()` is modified by the `onlyDealsController` and can only be called by the `DealsController` contract, which is inconsistent with the 119 lines of code that show that the function can also be called by the owner of the point. ```solidity=118 require( address(_dealsController) == msg.sender || ownerAddr == msg.sender, 'only owner or deals controller can withdraw' ); ```

In the function `createLiquidity()` of the contract GigaSwapToken, the event emits a wrong value. ```solidity=420 _balances[msg.sender] = 1e19; emit Transfer(address(0), msg.sender, initialLiquidity); ```

The `transferToAsset()` function can be called by anyone to transfer assets to the current contract. The `transferToAssetFrom()` function does the same thing, but is modified by `onlyFactory`.

The contract has one or more payable functions, but does not have a function to withdraw the fund. ```solidity=5 receive() external payable; ``` ```solidity=58 function execute(uint256 pointId, address addr) external payable; ``` ```solidity=65 function withdraw(uint256 pointId) external payable; ``` ```solidity=25 receive() external payable {} ``` ```solidity=110 function withdraw(uint256 pointId) external payable onlyDealsController { ``` ```solidity=129 function execute(uint256 pointId, address addr) ```

In the contracts `PositionsController`, `PositionsFactory`, `TradingPairAlgorithm`, `AssetsControllerBase`, `Erc20AssetsController`, `Erc721ItemAssetsController`, `EthAssetsController` and `VoteExecutorBase`, there are functions that can receive Ethers: * PositionsController.transferToAsset() * PositionsController.transferToAssetFrom() * PositionsFactory.createLockPosition() * PositionsFactory.createTradingPairPosition() * TradingPairAlgorithm.addLiquidity() * AssetsControllerBase.transferToAsset() * Erc20AssetsController.initialize() * Erc721ItemAssetsController.initialize() * EthAssetsController.initialize() * VoteExecutorBase._startVote() These functions will calculate and deduct the required amount of Ether and send the extra Ethers back to ether the `msg.sender` or a passed-in surplus-receiving address.

In Erc20Sale.sol, the ordering logic incorporates the `positionId` parameter; however, it is worth noting that the order price is not related to the asset1/asset2 ratio within the position of `positionId`. Instead, the order price is determined by the buyer through the createOffer function, which takes input parameters asset1Count and asset2Count. The function `applyOffer` called by the buyer does not include a price check and will accept and execute the order in its entirety.