YYDS Finance security record

On-chain generated prices are susceptible to price manipulation as these values can be affected by users of the protocol. For now, token price is calculated via the tokenPrice() function below.

In swapAndDividend(), YYDS tokens are swapped to their USDT equivalent via the uniswapV2Router. After the swap, all the USDT in tokenReceiver is transferred to the marketingAddr and treasureAddr and this could lead to accounting errors if there was some USDT already in the tokenReceiver before the call to swapAndDividend(). Scenario: If another user sends in 1,000 USDT tokens to the tokenReceiver and the swap yields 500 USDT, it’ll send ~1,333USDT to the marketingAddr and ~166USDT to the treasureAddr which is 300% more than expected.

The YYDS token contract does not have any test cases and has not shown any results of thoroughly testing the protocol before launch. It is advised to have >95% code coverage before deploying protocols so as to reduce the surface area open to errors.

If ownership transfer is not done appropriately, the current contract owner can renounce/transfer ownership, lose owner privileges, and lose the ability to burn tokens. When ownership is renounced, all of the contract’s methods will be rendered unusable.

Throughout the codebase, there are functions marked as onlyOwner. These functions are guaranteed to revert when a regular user tries to call them. To reduce the amount of gas other users would waste if they call the function, the functions can carry the payable function modifier

Some of the contract functions that update the token’s state do not emit events when called. It is advisable for ease of tracking changes on the blockchain to emit events. The following functions could have events emitted when called: setBuyInterval, setMaxTokenVaulePerTx, setMaxTokenVauleSellPerTx, setIntervalDays, setBuyMarketingFee, setSellMarketingFee, setNumTokensSellToSwap, setMinAmountDeflation, and setMinAmountBurn.

In the course of transacting with contract addresses and swaps, there could be tokens mistakenly sent into the YYDS token contract and will remain stuck there with no means to claim them.

The codebase is replete with old packages from libraries that have gotten updates and newer releases. If the older versions are still in use and they contain bugs, then the entire codebase would be opened up to a larger attack surface than necessary. The ERC20 library used is an older version without the newer internal checks and custom error messages, it also uses the SafeMath library which is redundant from solidity versions >0.8.0 due to internal overflow and underflow checks.  The SafeERC20 library also exposes the safeApprove function which is deprecated to favor the use of safeIncreaseAllowance and safeDecreaseAllowance instead.

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

For addresses and values that do not change after deployment, they can be stored as immutable values to reduce gas costs for reading from storage. Some of these variables are tokenOwner, tokenReceiver, uniswapV2Pair and uniswapV2Router all set at deployment time in the constructor.