Hawksight

In the contract `lib.rs`, the role `authority` has authority over the following function: - change_multi_index_farm_rate(): change the speed at which farms generate rewards; - create_saber_farm_strategy(): add a new strategy. Any compromise to the privileged accounts may allow a hacker to take advantage of this to update project configurations.

A Solana program can be deployed on the mainnet as: * final: the code cannot be updated. * upgradable: `BPFLoaderUpgradeable` needs to be set as the program owner and an `upgrade authority`, which is a user account, is given. In case the `Hawksight` program is deployed as upgradable, the `upgrade authority` has the privilege to update the implementation of the program at his/her will. Any compromise to the `upgrade authority` account may allow a hacker to take advantage of this authority and control the implementation of the program and therefore execute potential malicious functionalities in the program.

In Rust, it is standard practice to prefix unused parameters with `_`. However `_ctx` is used in all the referenced functions.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

The contract is serving as the underlying entity to interact with third party `QuarryProtocol`, `spl-swap` and `stable-swap` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.