NoriGO! security record

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity=43 function name() public view virtual override returns (string memory) { ``` --- ```solidity=47 function symbol() public view virtual override returns (string memory) { ``` --- ```solidity=51 function decimals() public view virtual override returns (uint8) { ``` --- ```solidity=63 function transfer(address recipient, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=68 function allowance(address owner, address spender) public view virtual override returns (uint256) { ``` --- ```solidity=72 function approve(address spender, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=77 function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=89 function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) { ``` --- ```solidity=94 function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) { ```

In the contract `NoriGO`, it is noted that the `lpPairEth` is missing a check in the **linked** statements, yet the `lpPair` is checked.

The contract takes the fee from the transfer, and the fee rate for the selling can be updated by calling `updateSellFees()`. And the maximum fee rate for selling may reach as higher as 12%.

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `swapExactTokensForTokensSupportingFeeOnTransferTokens()` - `swapExactTokensForETHSupportingFeeOnTransferTokens()` - `addLiquidity()` - `addLiquidityEth()`

The contract is serving as the underlying entity to interact with the third-party protocols. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. - The contract `NoriGO` interacts with the third-party contract with `IDexRouter` interface via `dexRouter`. - The contract `NoriGO` interacts with the third-party contract with `IERC20` interface.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=185 IERC20(token).transfer(owner(), IERC20(token).balanceOf(address(this))); ``` --- ```solidity=632 pair.transfer(liquidityAddress1, lpPairBalance * percentLpToAddress1 / 100); ``` --- ```solidity=635 pair.transfer(liquidityAddress2, pair.balanceOf(address(this))); ``` --- ```solidity=651 pair.transfer(liquidityAddress1, lpPairBalance * percentLpToAddress1 / 100); ``` --- ```solidity=654 pair.transfer(liquidityAddress2, pair.balanceOf(address(this))); ``` --- ```solidity=693 STABLECOIN.transfer(projectAddress, STABLECOIN.balanceOf(address(this))); ```

The return values of an external call are not used in the contract. ```solidity=623 STABLECOIN.approve(address(dexRouter), stablecoinAmount); ``` --- ```solidity=626 dexRouter.addLiquidity(address(this), address(STABLECOIN), tokenAmount, stablecoinAmount, 0, 0, address(this), block.timestamp); ``` --- ```solidity=645 dexRouter.addLiquidityETH{value: ethAmount}(address(this), tokenAmount, 0, 0, address(this), block.timestamp); ``` --- ```solidity=731 (success, ) = projectAddress.call{value: address(this).balance}(""); ```

The linked variable `futureOwnerAddress` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.