LfgSwap Ⅱ

CertiK27 Mar 2023Files named in the report

Audit

CertiK reviewed LFGSwap (LfgSwap Ⅱ) on 27 Mar 2023: 10 findings, 0 critical; 6 marked fixed, 4 open.

No open critical findings

Open the report Open LFGSwap’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	2	1
Medium	0	1
Low	2	4

HighCentralization Risk in function finalWithdrawOpen

The owner can withdraw users' raiseToken via the function `finalWithdraw()` without the consensus of the community. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and all the users will suffer the loss of their investment funds.

HighLack of reasonable boundariesOpen

In the function `calculateOfferingAndRefundingAmountsPool()`, the `userRefundingAmount` will deduct the user's share of raisingAmountPool. We would like to confirm whether this implementation aligns with the original project design. Meanwhile, the `raisingAmountPool` is set by the owner without any reasonable upper boundaries.

LowInaccurate CommentOpen

In function `calculateOfferingAndRefundingAmountsPool()`, the comment for the following `userOfferingAmount` calculation is inaccurate for the scenario of when `raisingAmountPool` <= `totalAmountStake` ```solidity=628 // userInfo[_user] / (raisingAmount / offeringAmount) userOfferingAmount = userInfo[_user].amount.mul(offeringAmountPool).div( raisingAmountPool ); ```

LowTo Be Implemented FunctionOpen

`beforeHarvest()` function is not implemented in the `IFOInitializableMix.sol` contract