Internet Money security record

In the contract `InternetMoneySwapRouter` the role `_owner` has authority over the functions shown in the following functions: - addDex() - updateDex() - disableDex() Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add/disable DEX supported, or change sensitive contract state data.

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit or manipulate the token price in decentralized exchanges. The `checkPairForValidPrice` function relies on price calculations that are based on-chain, meaning they are susceptible to flash-loan attacks by manipulating the price of given (targetToken, _wNative) pairs to the attacker's benefit.

The application provides the "claim airdrop" feature for new users to claim a small amount of BNB and IM tokens. The feature was exploited before the audit started, and now it's protected with re-captcha and IP-based rate limiting. However, the protection can be easily bypassed, and the attacker will be incentivized to abuse the feature if the airdrop reward is higher than the cost of getting phone numbers to receive an SMS code and an IP rotator.

The contract is serving as the underlying entity to interact with one or more third-party DEX protocols. The scope of the audit treats third-party DEX protocols as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=33 Dex[] public dexInfo; ``` - The contract `InternetMoneySwapRouter` interacts with third-party contract with `IUniswapV2Router02` interface via `dexInfo`. --- ```solidity=54 function amountOutFrom(address factory, address tokenIn, address tokenOut, uint256 amountIn) public view returns(uint256) { ``` - The function `OracleReader.amountOutFrom` interacts with third-party contract with `IUniswapV2Factory` interface via `factory`. --- ```solidity=90 function checkPairForValidPrice(address factory, address token) public view returns(uint256 tokenReserve, uint256 wethReserve) { ``` - The function `OracleReader.checkPairForValidPrice` interacts with third-party contract with `IUniswapV2Pair` interface via `factory`.