LFGSwap security record

State variables initialized when declared are equivalent to initializing them inside the constructor. Therefore, initializing state variables when declared in an upgradeable contract has no actual effect since the constructor of an upgradeable contract is never called.

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

The state variable `lastRewardAt` is initialized in the function `updatePool()`. However, the `updatePool()` is not called in the function `initializeMint()`, which means the mint rewards do not start to accumulate. In the current logic, the first `updatePool()` will be called during the first time of deposit and the mint starts.

`endAt` is the variable that checks if the IFO will be ended, so its value has to be later than the current blockstamp.

```solidity=355 function _withdrawReferralReward(address user) private { uint256 rewardAmount = userReferralReward(user); if(rewardAmount > 0) { offeringToken.safeTransfer(user, rewardAmount); emit HarvestReferralReward(user, rewardAmount); } } function userReferralReward(address user) public view returns (uint256 rewardAmount) { uint256 point = referralPoint[user]; if(point > 0 && totalRewardPoint > 0 ) { //expect data uint256 offering = totalRewardOffered; rewardAmount = point.mul(offering).div(totalRewardPoint); } } ``` In the above function `_withdrawReferralReward()`, the total number of transferred rewards is not recorded and tracked. Since both `totalRewardPoint` and `totalRewardOffered` may be changed, the number of `rewardAmount` would be also impacted and therefore the total number of transferred `rewardAmount` would be potentially messed up.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=18 abstract contract IFOInitializableMix is ReentrancyGuardUpgradeable, OwnableUpgradeable { ``` - `IFOInitializableMix` is an upgradeable contract that does not protect its initializer. ```solidity=127 function initialize( ``` - `initialize` is an unprotected initializer function.