Old IDO & NFT Launchpads Upgrades (Agency Work)

In the contract `SeedifyFundBUSD.sol` the role `_owner` has authority over the functions: - `addWhitelist()` - `updateTierUsersValue()` - `updateTierValues()` - `setTokensPerBUSD()` - `setRefundThresholdTime()` Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and 1) Add users to the whitelist using the `addWhitelist()` function allowing them to buy tokens using the `buyToken()` function. 2) Change the `tiersMaxCap[]` array that decides the maximum amount of tokens that can be bought by users of one particular tier, and the `maxAllocaPerUserInTiers[]` array that decides the amount of tokens that can be bought by a user in a particular tier. 3) Change the 'totalUserInTiers[]' array that keeps track of the total number of users in a whitelist, alongside the `maxAllocaPerUserInTiers[]` array. 4) Change the `tokensPerBUSD` and `refundThresholdTime` using the `setTokensPerBUSD()` and `setRefundThresholdTime()` functions respectively. In addition, in the contract `SeedifyFundBUSD.sol` the `projectOwner` is set in the `constructor()` and receives all `BUSD` from buys and also is the source of `BUSD` in `refund()`. If the `projectOwner` does not hold enough `BUSD`, then `refund()` will revert. In the contract `INOLaunchpadSmartContract.sol` the role `_owner` has the authority over the following functions: - `updateNFTprice()` - `pause()` - `unpause()` - `addWhitelist()` - `removeWhitelist()` Any compromise to the '_owner' account may allow the hacker to take advantage of this authority and 1) Alter the `nftPrice` using the `updateNFTprice()` function. 2) Prevent everyone from buying new tokens using the 'pause()' function. 3) Allow users to buy new tokens using the `unpause()` functions, when they are not intended to. 4) Add or remove users from the `whitelist[]` array, using the `addWhitelist()` and `removeWhitelist()` functions respectively.

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user stakes 100 deflationary tokens (with a 10% transaction fee) in a MasterChef contract, only 90 tokens actually arrive in the contract. However, the user can still withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. In the `buyTokens()` function, the amount of tokens sent to the msg.sender is tracked by the variable `buyInOneTier[]`. If the token is deflationary, the amount of tokens received by the msg.sender would be less than what the `buyInOneTier[]` is increased by and in the `refund()` function, even if the `buyInOneTier[msg.sender] >= amount`, the `msg.sender` might still not have enough tokens.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. The contract `SeedifyFundsContract` interacts with third party contract with `IERC20` interface via `ERC20Interface` and `IGOTokenInterface`.

There are the following typos in `INOLaunchpadSmartContract`: - In `buyTokens()`, it should be "You have already bought the item" instead of "You have already buy the item". - In `buyTokens()`, it should be "Amount is different" instead of "amount is different". - In the comment for `totalBUSDReceivedInAllTier` it should be `BUSD` not `bnd`.