LFGSwap security record
As of 3 Nov 2026, LFGSwap has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 27 Mar 2023. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
Findings28
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 5 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 17 | 0 | 4 |
HighCentralization Risk in function finalWithdrawLfgSwap Ⅱ · CertiK · 27 Mar 2023Open
The owner can withdraw users' raiseToken via the function `finalWithdraw()` without the consensus of the community. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and all the users will suffer the loss of their investment funds.
Open the reportHighLack of reasonable boundariesLfgSwap Ⅱ · CertiK · 27 Mar 2023Open
In the function `calculateOfferingAndRefundingAmountsPool()`, the `userRefundingAmount` will deduct the user's share of raisingAmountPool. We would like to confirm whether this implementation aligns with the original project design. Meanwhile, the `raisingAmountPool` is set by the owner without any reasonable upper boundaries.
Open the reportHighCentralization Risks in LfgSwapFactory.solLFGswap · CertiK · 21 Oct 2022Open
In the contract `LfgSwapFactory` the role `feeToSetter` has authority over the functions shown in the diagram below. Any compromise to the `feeToSetter` account may allow the hacker to take advantage of this authority and set `feeTo`. 
Open the reportHighCentralization Risks in LfgToken.solLFGswap · CertiK · 21 Oct 2022Open
In the contract `LfgToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add or delete `Minter` role.  In the contract `LfgToken`, the role `_minters` has authority over the `mint()` function. Any compromise to the `_minters` account may allow a hacker to take advantage of this authority and mint new tokens.
Open the reportHighInitial Token DistributionLFGswap · CertiK · 21 Oct 2022Open
Tokens are sent to `msg.sender` when deploying the contract. This could be a centralization risk as the `msg.sender` can distribute tokens without obtaining the consensus of the community.
Open the reportLowInaccurate CommentLfgSwap Ⅱ · CertiK · 27 Mar 2023Open
In function `calculateOfferingAndRefundingAmountsPool()`, the comment for the following `userOfferingAmount` calculation is inaccurate for the scenario of when `raisingAmountPool` <= `totalAmountStake` ```solidity=628 // userInfo[_user] / (raisingAmount / offeringAmount) userOfferingAmount = userInfo[_user].amount.mul(offeringAmountPool).div( raisingAmountPool ); ```
Open the reportLowTo Be Implemented FunctionLfgSwap Ⅱ · CertiK · 27 Mar 2023Open
`beforeHarvest()` function is not implemented in the `IFOInitializableMix.sol` contract
Open the reportLowCommented Out CodeLFGswap · CertiK · 21 Oct 2022Open
Commented out code is redundant.
Open the reportLowDivide by ZeroLFGswap · CertiK · 21 Oct 2022Open
The call to `burn()` function will fail if the value of `_totalSupply` is 0.
Open the reportLowFunction Should Be Declared ExternalLFGswap · CertiK · 21 Oct 2022Open
The functions which are never called internally within the contract should have external visibility for gas optimization.
Open the reportShow 10 more
LowIncorrect CommentLFGswap · CertiK · 21 Oct 2022Open
Based on the coefficient `mul(2)` and based on the formula at 2.4 of https://uniswap.org/whitepaper.pdf, the correct fee is equivalent to 1/3th.
Open the reportLowMissing Input ValidationLFGswap · CertiK · 21 Oct 2022Open
In function `_burn()`, `_approve()` and `_transfer()`, addresses should be checked before assigning to make sure they are not zero addresses.
Open the reportLowMissing Zero Address ValidationLFGswap · CertiK · 21 Oct 2022Open
Addresses should be checked before assignment or external call to make sure they are not zero addresses.
Open the reportLowPotential Integer UnderflowLFGswap · CertiK · 21 Oct 2022Open
In the function `LfgToken.getMinter()`, the input `_index` is checked to ensure the index is valid. However, it is possible that `getMinterLength() == 0` which might lead to integer underflow in the calculation: ```solidity=43 require(_index <= getMinterLength() - 1, "JfToken: index out of bounds"); ```
Open the reportLowRedundant CheckLFGswap · CertiK · 21 Oct 2022Open
In the `swap` function, the `require(amount0Out > 0 || amount1Out > 0, 'LfgSwap: INSUFFICIENT_OUTPUT_AMOUNT');` will always be satisfied due to the condition `if( amount0Out > 0 || amount1Out > 0 )`.
Open the reportLowRedundant Interfaces `IMigrator` and `ISwapMiningLFGswap · CertiK · 21 Oct 2022Open
The `IMigrator` and `ISwapMining` interfaces are not used by other code.
Open the reportLowTypo in File Name `SafaMath.sol`LFGswap · CertiK · 21 Oct 2022Open
There is a typo in the file name `SafaMath.sol`.
Open the reportLowTypos in `require()` Check Error MessagesLFGswap · CertiK · 21 Oct 2022Open
There is a typos in `require` messages: - `UniswapV2Library` expected `LfgSwapLibrary`; - `UniswapV2` expected `LfgSwap`. - `JfToken` expected `LfgToken`
Open the reportLowUnused Import FileLFGswap · CertiK · 21 Oct 2022Open
The following import file is not used in the audit files: ````Solidity=3 import "@openzeppelin/contracts/access/Ownable.sol"; ````
Open the reportLowUnused Library `FixedPoint`LFGswap · CertiK · 21 Oct 2022Open
The library `FixedPoint` is never used within the project and thus can be removed.
Open the reportShow 2 more
LowUser-Defined GettersLFGswap · CertiK · 21 Oct 2022Open
The linked functions are equivalent to the compiler-generated getter functions for the respective variables.
Open the reportLowVariables That Could Be Declared as ImmutableLFGswap · CertiK · 21 Oct 2022Open
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lfgswap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us