FlokiFi security record

In the contract `FlokiStakingPool` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - `extendRewardsDuration()`, to extend the duration of the reward. - `initializeStaking()`, to initialize the staking. - `recoverERC20()`, to transfer erc20 tokens to the owner except the staking/reward token. - `transferOwnership()`, to transfer ownership to new owner. 

All of the xFLOKI tokens are sent to the contract deployer. This is a centralization risk because the deployer can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

In the contract `Whitelist` the role `WHITELIST_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `WHITELIST_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `PricingModuleV1` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `ChainlinkPriceConsumer` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `ChainlinkPriceConsumer` the role `ORACLE_MANAGER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `ORACLE_MANAGER_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `DiaPriceConsumer` the role `ORACLE_MANAGER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `ORACLE_MANAGER_ROLE` account may allow the hacker to take advantage of this authority .  In the contract `ManualPriceConsumer` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority .  In the contract `PriceOracleManagerV1` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority .  In the contract `PriceOracleManagerV1` the role `ORACLE_MANAGER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `ORACLE_MANAGER_ROLE` account may allow the hacker to take advantage of this authority .  In the contract `PythPriceConsumer` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `PythPriceConsumer` the role `ORACLE_MANAGER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `ORACLE_MANAGER_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `VaultDeployer` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `VaultDeployer` the role `_fromfactory` has authority over the functions shown in the diagram below. Any compromise to the `_fromfactory` account may allow the hacker to take advantage of this authority.  In the contract `VaultDeployer` the role `vaultFactory` has authority over the functions s

In the contract `PaymentModuleV1`, the role `DEFAULT_ADMIN_ROLE` has authority over the following functions: - function setLPTokenProcessor(), to set the `lpTokenProcessor`. - function setPricingModule(), to set the `pricingModule`. - function setTreasury(), to set the `treasury`. In the contract `LPTokenProcessorV1`, the role `DEFAULT_ADMIN_ROLE` has authority over the following functions: - function setSellDelay(), to set the `_sellDelay`. In the contract `PricingModuleV1`, the role `DEFAULT_ADMIN_ROLE` has authority over the following functions: - function setLPTokenProcessor(), to set the `lpTokenProcessor`. - function setTokenPrice(), to set the `TOKEN_PRICE`. - function setVestedTokenPrice(), to set the `VESTED_TOKEN_PRICE`. - function setLPBasisPoints(), to set the `LP_TOKEN_BASIS_POINTS`. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority.

In the contract `LPTokenProcessorV1`, the role `LP_ADMIN_ROLE` has authority over the following functions: - function adminWithdraw(), to withdraw any amount of the ETHs and tokens in the contract to the `LP_ADMIN_ROLE`. - function setMaxSellBatchSize(), to set the `_maxSellBatchSize`. Any compromise to the `LP_ADMIN_ROLE` account may allow a hacker to take advantage of this authority.

In the contract `VaultFactory`, the role `owner` has authority over the following functions: - function setKeyAddress(), to set the `keyNFT`. - function updatePaymentModule(), to set the `paymentModule`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority.

The contract is serving as the underlying entity to interact with one or more third-party protocols. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. In PriceOracleManagerV1 ```solidity function fetchPriceInUSD(address token) external override onlyRole(ORACLE_MANAGER_ROLE) { for (uint256 i = 0; i < oracles.length; i++) { IPriceConsumer oracle = IPriceConsumer(oracles[i]); uint256 minTimestamp = block.timestamp - validPriceDuration; try oracle.fetchPriceInUSD(token, minTimestamp) { (uint256 price, uint256 decimals, uint256 timestamp) = oracle.getPriceInUSD(token); if (block.timestamp - timestamp > validPriceDuration) { // too old, look at the next oracle continue; } _tokenPrices[token] = price; _tokenPriceDecimals[token] = decimals; } catch { // oracle failed, look at the next oracle continue; } } } ``` In the function `fetchPriceInUSD()`, as long as the update time of the price returned by the Oracle is less than validPriceDuration, the price returned by the Oracle may be utilized. As a result, users might manipulate the Oracle to enable the function to use potentially exploitable Oracle instances. Due to the `fetchPriceInUSD()` function being accessible only to the `ORACLE_MANAGER_ROLE`, the likelihood of this scenario occurring is relatively low.

In this project, investors could create vaults and deposit ERC20, ERC721, or ERC1155 assets in the `VaultFactory` contract, fees would be charged and these assets would be locked for a period of time, however, it is still unclear how the investors would profit from this project, and we would like the client to provide with more information about it.

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction is attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `router.removeLiquidity()` - `router.swapExactTokensForETH()`

The contract is serving as the underlying entity to interact with one or more third-party protocols. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=20 IUniswapV2Router01 public router; ``` - The contract `LPTokenProcessorV1` interacts with third-party contract with `IUniswapV2Router01` interface via `router`.