DAOFi

In the function `DAOfoV1Pair._convert()`, when dividing `amount` by `factor`, if `amount` is lower than factor, the input `amount` is not converted (probably to avoid truncation). The function will return the unconverted amount without any information regarding if it was converted or not. All implemented functions that use `_convert()` will process the returned value as if it was converted which is incorrect and can lead to loss of funds for both liquidity provider and users.

The pool logic is poorly documented in the code, which impairs external auditing. Furthermore, the implemented logic lacks proper specification. For instance, we couldn't determine the severity of some of the issues and their impact on the system.

In the function `getQuoteOut()` if `amountBaseIn` is equal to or higher than `supply`, the function returns the value of `amountQuoteOut` equal to `quoteReserve` meaning that the token swap is be calculated without any slippage (fixed exchange rate) which is contradictory to the implemented bonding curve where the price varies following the amount to be exchanged. Furthermore, user could exchange too many input tokens, since the function returns the same amount out for any value `amountBaseIn` >= `supply`.

Unintentional swaps may occur in the functions `swapExactTokensForTokens()` and `swapExactTokensForETH ()` since both take `sp.sender` as an argument instead of using `msg.sender`.

The following functions do not check if arguments of type address are non-zero: * `DAOfiV1Pair.initialize()`, * `DAOfiV1Pair.setPairOwner()`, * `DAOfiV1Factory.constructor()`, * `DAOfiV1Factory.createPair()`, * `DAOfiV1Router01.constructor()`.

A block is an ordered collection of transactions from all around the network. It's possible for the ordering of these transactions to manipulate the end result of a block. A miner attacker can take advantage of this by generating and moving transactions in a way that benefits themselves. Specifically, there may be a race condition between transferring tokens to the pair contract and calling the function `swap()`.