Orcania security record

Tokens are sent to the deployer `msg.sender` when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

The order of external call/transfer should follow the check-effect-interaction pattern. A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. Those mentioned functions are for swapping or setting liquidity, the external `IERC20(token).transferFrom()` functions, which cannot be fully trusted, are called before updating state variables, so there is a risk of reentrancy attack at these locations. ### External call(s) ```solidity=90 IERC20(tokenIn).transferFrom(msg.sender, address(this), amountIn); ``` * This call transfers tokens. ### State variables written after the call(s) ```solidity=92 uint256 amountOut = SwapTokenForOCA(tokenIn, amountIn); ``` * This function call executes the following assignment(s). * In `DEX.SwapTokenForOCA`, * `_tokenOCAbalance[token] -= amountOut` --- ### External call(s) ```solidity=100 IERC20(tokenIn).transferFrom(msg.sender, address(this), amountIn); ``` * This call transfers tokens. ### State variables written after the call(s) ```solidity=102 uint256 amountOut = SwapTokenForOCA(tokenIn, amountIn); ``` * This function call executes the following assignment(s). * In `DEX.SwapTokenForOCA`, * `_tokenOCAbalance[token] -= amountOut` ```solidity=103 uint256 amountOut1 = SwapOCAForToken(tokenOut, amountOut); ``` * This function call executes the following assignment(s). * In `DEX.SwapOCAForToken`, * `amountOut = mul(amountIn,IERC20(token).balanceOf(address(this)),999) / ((_tokenOCAbalance[token] += amountIn) * 1000)` --- ### External call(s) ```solidity=111 IERC20(tokenIn).transferFrom(msg.sender, address(this), amountIn); ``` * This call transfers tokens. ### State variables written after the call(s) ```solidity=113 uint256 amountOut = SwapTokenForOCA(tokenIn, amountIn); ``` * This function call executes the following assignment(s). * In `DEX.SwapTokenForOCA`, * `_tokenOCAbalance[token] -= amountOut` ```solidity=114 uint256 amountOut1 = SwapOCAForCoin(amountOut); ``` * This function call executes the following assignment(s). * In `DEX.SwapOCAForCoin`, * `amountOut = (amountIn * address(this).balance * 999) / ((_tokenOCAbalance[address(0)] += amountIn) * 1000)` --- ### External call(s) ```solidity=169 IERC20(token).transferFrom(msg.sender, address(this), amount); ``` * This call transfers tokens. ```solidity=170 OCA.transferFrom(msg.sender, address(this), OCAamount); ``` * This call sends OCAs. ### State variables written after the call(s) ```solidity=176 _points[msg.sender][token] = userPoints; ``` ```solidity=177 _points[address(this)][token] = OCAamount - userPoints; ``` ```solidity=174 _tokenOCAbalance[token] = OCAamount; ``` --- ### External call(s) ```solidity=193 IERC20(token).transferFrom(msg.sender, address(this), amount); ``` * This call transfers tokens. ### State variables written after the call(s) ```solidity=201 _points[msg.sender][token] += userPoints; ``` ```solidity=202 _points[address(this)][token] += earnedPoints - userPoints; ```