DAOFi

A Denial-of-Service (DoS) attack is a situation which an attacker renders some functionality unavailable. Specifically the function `createPair()` is prone to a DoS attack through front-running. A malicious user may front-run the function and provide a different `pairOwner` argument. Consequently, a new pair contract would have an owner chosen by the attacker. The same issue applies to functions `addLiquidity()` and `addLiquidityETH()`.

When initializing `DAOfiV1Pair` using the function `initialize()`, following the natspec documentation, `_n` value should be between 1 and 3. However, the hardcoded `MAX_N` value is equal to 1 instead of 3 as documented.

The functions `deposit()` and `withdraw()` can be called only once by the router contract, meaning that users won't be able to provide liquidity after the initial deposit call. Such implementation will cause higher slippage since there will be less liquidity in the pools (only one user is allowed to deposit, and only the owner is allowed to withdraw).

Since the pool is designed to allow only one liquidity provider, only the owner should be able to add and remove liquidity via `addLiquidity()` and `removeLiquidity()`. If another user uses a deployed pair and provides liquidity (through `addLiquidity()` or `addLiquidityETH()`), they will not be able to withdraw their deposit since only the owner is allowed to do so. Furthermore, a malicious user can deposit a small amount of tokens to deny service for the pool owner.

The L25 contains hardcoded code hash.

Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. Specifically, unvetted tokens may consume all the passed gas in L84.

The function `_convert()` converts token amounts so that they have 8 decimals. This may result in lost precision.

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract.

DAOfi pair contract computations are incompatible with rebasing tokens.