KyotoSwap security record

The `initialize()` function in the contract `KswapToken` and `MasterChef` is not protected and can be called by anyone.

The contracts have different or unlocked compiler versions. Different or unlocked compiler versions in the source code of the contract permit the user to compile the code at different versions. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

The function `migrate()` in the Library `LibTokenLocker` has not been used. It will create a new lock or add the input amount to an existing lock without an actual `lockedToken` transfer from the user. Also, the function does not transfer the redeemed tokens to the users but starts a new lock even if the old lock has expired.

Performing integer division before multiplication truncates the low bits, losing the precision of the calculation. For example: ```solidity=343 user.rewardDebt = user .amount .mul(multiplier) .div(BOOST_PRECISION) .mul(pool.accKswapPerShare) .div(ACC_KSWAP_PRECISION); ``` --- ```solidity=375 user.rewardDebt = user .amount .mul(multiplier) .div(BOOST_PRECISION) .mul(pool.accKswapPerShare) .div(ACC_KSWAP_PRECISION); ``` --- ```solidity=498 user.rewardDebt = user .amount .mul(_newMultiplier) .div(BOOST_PRECISION) .mul(pool.accKswapPerShare) .div(ACC_KSWAP_PRECISION); ```

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur.

Functions that update state variables should emit relevant events as notifications.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. For example, the linked functions contain state variables that are updated after the external calls and consequentially are vulnerable to potential reentrancy attacks.

Comparisons that are always true or always false may be incorrect or unnecessary. ```solidity=608 require(_lpToken.balanceOf(address(this)) >= 0, "None BEP20 tokens"); ```

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. For example: ```solidity=38 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `MasterChef` contract. ```solidity=190 uint256 multiplier = block.number.sub(pool.lastRewardBlock); ``` - `SafeMath.sub` is called in `pendingKswap` function of `MasterChef` contract. *Note: Only a sample `SafeMath` library usage in this contract is shown above.*