Centralized Control of Contract Upgrade

`SafeMath` Is Unnecessary

Use `revert` Instead of `require`

`route.amountAfterFee` Should Be A Fixed Value

Lack of Input Validation

Centralization Risk in ArkenDexV3.sol

Arken Swap v2

ArkenApprove.sol

IArkenApprove.sol

OwnableUpgradeable.sol

UniswapV2Library.sol

Interfaces.sol

IBakeryRouterV2.sol

contracts

IEtherWrapper.sol

IDODOV2.sol

TimelockController.sol

UniswapV3CallbackValidation.sol

IWETH.sol

ProxyAdmin.sol

TransparentUpgradeableProxy.sol

IBakeryPair.sol

IVyperUnderlyingSwap.sol

interfaces

IBalancer.sol

IDoppleSwap.sol

IUniswapV2AVAXRouter.sol

ArkenDexV3.sol

IDODOV2Proxy.sol

IVyperSwap.sol

`ArkenApprove` is an upgradeable contract, the proxy admin can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the function of the contract and take tokens from users who have approved to this contract.


`SafeMath` is generally not needed starting with Solidity 0.8, since the compiler now has built in overflow checking.

`require` statement can be replaced by `revert`.

In the function `_tradeUniswapV2`, it calls `UniswapV2Library.getAmountOut` to calculate `amountOut`. For UniswapV2, the trading fee is a fixed partition 3/1000, so the parameter here `route.amountAfterFee` should be 997; it should be a fixed value instead of an input parameter. For some mistakes, it may be less than 997, like 996, which causes users to lose assets. There is a same issue in the function `_tradeBakery`.

In the function `trade`, the value of `desc.amountOutMin` should be set in case of users ignore setting the value.

In the contract `ArkenDexV3` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update `_ARKEN_APPROVE_` and take tokens from approved users.

![](https://accelerator-tasks-prod.s3.amazonaws.com/163fb8ca84c94813a93e7f731f2af75c/diagrams/centralization-ArkenDexV3-_owner.svg)

Arken Swap

Arken Finance

Arken Finance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

6

0

1

2

3