Internet Money Swap Router - BNB Smart Chain (BSC)

In the contract `InternetMoneySwapRouter` the role `_owner` has authority over the functions shown in the following functions: - addDex() - disableDex() - updateTokenFee() Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add/disable DEX supported, or change sensitive contract state data.

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit or manipulate the token price in decentralized exchanges. The `checkPairForValidPrice` function relies on price calculations that are based on-chain, meaning they are susceptible to flash-loan attacks by manipulating the price of given (targetToken, _wNative) pairs to the attacker's benefit.

The contract is serving as the underlying entity to interact with one or more third-party DEX protocols. The scope of the audit treats third-party DEX protocols as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=33 Dex[] public dexInfo; ``` - The contract `InternetMoneySwapRouter` interacts with third-party contract with `IUniswapV2Router02` interface via `dexInfo`. --- ```solidity=54 function amountOutFrom(address factory, address tokenIn, address tokenOut, uint256 amountIn) public view returns(uint256) { ``` - The function `OracleReader.amountOutFrom` interacts with third-party contract with `IUniswapV2Factory` interface via `factory`. --- ```solidity=90 function checkPairForValidPrice(address factory, address token) public view returns(uint256 tokenReserve, uint256 wethReserve) { ``` - The function `OracleReader.checkPairForValidPrice` interacts with third-party contract with `IUniswapV2Pair` interface via `factory`.