Primex Finance

The functions getAmountsIn(), getAmountsOut(), and getGas() do not implement the possibility of calculating beforehand the amount of tokens and gas that will be used to swap through the function _swapExactTokensForTokens(). Users will have to perform swaps by trial and error without previously knowing accurate calculation estimates.

Provided protocol specification, and specifically the recent changes, regarding Oracle contract's implementation state that if Oracle Route's length is equal to four, then Pyth and Chainlink Oracles cannot be neither the first nor the last step in the whole path. This requirement was formulated to assure only expected token conversions are permitted. However, it was observed that the implementation of such mechanism is not complete. Namely, it does verify that Pyth and Chainlink Oracles are not the first step in the four-step route, but they do not assert they are not the last. Hence, the scenarios that were supposed to be prevented by design are actually possible.

The function setProtocolParamsByAdmin() does not implement access control allowing any user to delegate calls to PositionManagerExtension.While this does not present an immediate threat since all administrative functions on PositionManagerExtension possess proper access control, current or future functions that do not have any access control implemented may be at risk.