Read the findings of the 2022 Web3 Security Report

In contract `AcyV1Distribution`, the role `owner` has the authority over the following function:
 - function renounceOwnership()
 - function transferOwnership()
 - function setGovernerContract()
 - function setDistributionItem()
 - function editDistributionItem()

In contract `AcyV1Distribution`, the role `GovernerContract` has the authority over the following function:
 - function setGovernerContract()
 - function setDistributionItem()
 - function editDistributionItem()

In contract `AcyV1FlashArbitrage`, the role `owner` has the authority over the following function:
 - function renounceOwnership()
 - function transferOwnership()
 - function transferRouter()
 - function getPoint()

In contract `AcyV1FlashArbitrage`, the role `_router` has the authority over the following function:
 - function pushPoint()
 - function calXiArr()
 - function calYiArr()

In contract `AcyV1Points`, the role `owner` has the authority over the following function:
 - function renounceOwnership()
 - function transferOwnership()
 - function transferFlashArbitrage()

In contract `pushPoint`, the role `_flashArbitrage` has the authority over the following function:
 - function renounceOwnership()

In contract `ACYMultiFarm`, the role `POOL_MANAGER_ROLE` has the authority over the following function:
 - function registerToken()
 - function createPool()
 - function setAllocPoint()
 - function fund()
 - function setRewardPerBlock()

In contract `ACYMultiFarm`, the role `PAUSER_ROLE` has the authority over the following function:
 - function pause()
 - function unpause()

In contract `ACYMultiFarm`, the role `WHITELISTER_ROLE` has the authority over the following function:
 - function enableSponsorshipForAddress()
 - function disableSponsorshipForAddress()

In contract `AcyV1Poolz`, the role `owner` has the authority over the following function:
 - function renounceOwnership()
 - function transferOwnership()
 - function SwitchIsPayble()
 - function setGovernerContract()
 - function SetMinMaxETHInvest()
 - function SetMinMaxERC20Invest()
 - function pause()
 - function unpause()
 - function CreatePool()
 - function UpdatePoolDistribution()
 - function ResetPoolDistribution()
 - function WithdrawERC20ToCreator()

In contract `AcyV1Poolz`, the role `GovernerContract` has the authority over the following function:
 - function setGovernerContract()
 - function SetMinMaxETHInvest()
 - function SetMinMaxERC20Invest()
 - function pause()
 - function unpause()
 - function CreatePool()
 - function UpdatePoolDistribution()
 - function ResetPoolDistribution()
 - function WithdrawERC20ToCreator()

without obtaining the consensus of the community.

Centralization Related Risks

The contract is serving as the underlying entity to interact with third party protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The functions that affect the status of sensitive variables should be able to emit events as notifications.

Missing Emit Events

There is a hardcode address `0x0888000000000000000000000000000000000001` in contract `ACYMultiFarm`. It can not be found on `Ethereum` or `BSC`. Please ensure it is correct when deploying.

Hardcode Address

```solidity=334
    if(cal.amountX<deltaX){
        cal.XiYiArrTmp[0] = cal.XiYiArrTmp[0].add(deltaX.sub(cal.amountX));
    }else if(cal.amountX>deltaX){
        cal.XiYiArrTmp[0] = cal.XiYiArrTmp[0].sub(cal.amountX.sub(deltaX));
    }
```
The formula `cal.XiYiArrTmp[0].add(deltaX.sub(cal.amountX))` is same as `cal.XiYiArrTmp[0].sub(cal.amountX.sub(deltaX))`.

Same Formula In Different Branches

```solidity=341
    if(cal.allPathTmp[0]==end){
        // token:begin->end
        AMMOutput = getTwoTokensPathAmountOut(cal.factory,deltaX, begin,end);
    }else{
        // token:begin->allPath[i]->end
        AMMOutput = getThreeTokensPathAmountOut(cal.factory,deltaX, begin,cal.allPathTmp[0],end);
    }
```
`cal.allPathTmp` is assigned as `cal.allPath`, which is the result of function `searchAllPath`. The first variable in `cal.allPath` maybe not `end`, and `end` is at another index. So there should be a loop to find the `end` in `cal.allPathTmp`, but not use the first item in `cal.allPathTmp` as above.

Incorrect Result Of `AMMOutput`

There is a modifier `onlyOwner` on function `AcyV1FlashArbitrage.getPoint()`， `AcyV1FlashArbitrage.getPoint()` call `IAcyV1Points.getPoint()`, `IAcyV1Points.getPoint()` has no access restrictions. So the modifier on function `AcyV1FlashArbitrage.getPoint()` is useless. Because user can call `IAcyV1Points.getPoint()` directly.

Unnecessary Modifier

```solidity=213
    for(uint k = 0;k<middleTokenLinkArr.length;k++){
        if(middleTokenLinkArr[k] == end){
            middleTokenNum = middleTokenNum + 1;
            middlePathTmp[i] = beginTokenLinkArr[i];
        }
    }
```
If the `end` token is found, the loop can finish immediately to save gas.

Missing Break In Loop

The given input is missing the check for the non-zero address.

Missing Input Validation

In function `editDistributionItem` of contract `AcyV1Distribution`, the judge statements should be stricter. When `shareTmp == 0` and `share != 0`, `availableItemNum` increases by 1. In contrary, when `shareTmp != 0` and `share == 0`, `availableItemNum` decreases by 1, in the current code, `availableItemNum` divided by 1 seems incorrect.

Incorrect Statements

In the current function `UpdatePoolDistribution`, one pool can be updated multiple times. If it is designed like this, we think `distributionTimeArr` updated later should be greater than the previous updated `distributionTimeArr`. Corresponding to the code, the initial value of `timeFlag` should be the last `distributionTimeArr` updated at the last time, but not 0. If one pool can only be updated once, there should be a check to ensure it can only be updated once.

Incorrect Logic In Function `UpdatePoolDistribution`

In contract `AcyV1Poolz`, Line1137 will judge if `distributionStatus == 0`, Line1146 will judge if `distributionStatus == 1`, but there is no place to update `distributionStatus` in contract `AcyV1Poolz`.

No Place To Update Variable `distributionStatus`

```solidity=1206
    require(
        pools[_PoolId].BaseData.Maincoin != address(0x0),
        "Pool is for ETH, use InvestETH"
    );
```
In function `InvestERC20`, the comment showed above indicates there is a function `InvestETH`.

Missing Function `InvestETH`

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 
- getAmountsOut
- getAmountsIn

Function Visibility Optimization

ACY Finance

AcyV1FlashArbitrage.sol

acy-finance

ACY Finance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

16

0

3

0

13