Ledger AI security record

The `Ledger` contract includes some hardcoded addresses ```solidity ... // initialize V2 router uniswapV2Router = IUniswapV2Router02( address(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D) ); // initialize V3 router uniswapV3Router = IUniswapV3Router( address(0xE592427A0AEce92De3Edee1F18E0157C05861564) ); ... ```

The `transferForeignToken` function lacks validation for the `_to` parameter, which represents the recipient's address. Without proper checks, an incorrect `_to` address could lead to irreversible loss of assets if tokens are sent to an unintended or non-recoverable address.

The compiler for Solidity 0.8.20+ switches the default target EVM version to [Shanghai](https://blog.soliditylang.org/2023/05/10/solidity-0.8.20-release-announcement/#important-note), which includes the new `PUSH0` op code. This op code may not yet be implemented on all L2s, so deployment on these chains will fail. To work around this issue, use an earlier [EVM](https://docs.soliditylang.org/en/v0.8.20/using-the-compiler.html?ref=zaryabs.com#setting-the-evm-version-to-target) [version](https://book.getfoundry.sh/reference/config/solidity-compiler#evm_version).

The `transferForeignToken` function does not check the return values when transferring ERC20 tokens. This can result in silent failures where the transfer is unsuccessful but the contract does not revert the transaction, potentially leading to unexpected side effects to the project. ```solidity function transferForeignToken( address _token, address _to ) external onlyOwner returns (bool _sent) { // ... _sent = IERC20(_token).transfer(_to, _contractBalance); // No check on the return value of transfer // ... } ``` In the `swapBack` function, the contract does not check the success of ETH transfers to `operationsAddress`, which can lead to silent transfer failures. ```solidity bool success; (success, ) = address(operationsAddress).call{value: ethForOperations}( "" ); (success, ) = address(marketingAddress).call{ value: address(this).balance }(""); require(success, "Transfer to operations address failed"); ``` Additionally, the error message in the `require` statement is inconsistent with the previous transfer to `marketingAddress`.

The `prepareLaunch` function in the contract is intended to initialize trading by creating liquidity pairs on Uniswap V2 and V3. However, it lacks a critical validation to ensure that the pairs have not been created by an external entity before being called by the owner. This can lead to a situation where a malicious user preempts the pair creation, causing the `prepareLaunch` function to fail. ```solidity function prepareLaunch() external onlyOwner { require(!tradingActive, "Trading is already active, cannot relaunch."); // ... uniswapV2Pair = IUniswapV2Factory(uniswapV2Router.factory()).createPair(...); uniswapV3Pair = IUniswapV3Factory(uniswapV3Router.factory()).createPool(...); // ... } ```