Read the findings of the 2022 Web3 Security Report

In the contract `DetfReflect` the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-DetfReflect-_owner.svg)


---


In the contract `Governor` the role `admin` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-Governor-admin.svg)

In the contract `Governor` the role `pendingAdmin` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-Governor-pendingAdmin.svg)

---


In the contract `GovernorProxy` the role `admin` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-GovernorProxy-admin.svg)


---


In the contract `Pool` the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-Pool-_owner.svg)

---

In the contract `Timelock` the role `admin` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-Timelock-admin.svg)

In the contract `Timelock` the role `pendingAdmin` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/6105259a3d3048378d180c9e0f4f1a9d/diagrams/centralization-Timelock-pendingAdmin.svg)


Any compromise to the privilege account may allow the hacker to take advantage of this authority and update the sentivie settings and execute sensitive functions of the project.

Centralization Related Risks

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

```solidity
// add the liquidity
uniswapV2Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
    tokenAmount,
    minAmountOut,
    path,
    pool,
    block.timestamp
);
```

The `_swapTokensForUSDC` function calls the `uniswapV2Router.swapExactTokensForTokensSupportingFeeOnTransferTokens` function with the `to` address specified as `pool` for acquiring the swapped tokens from the `Token-USDC` pool. As a result, over time the `pool` address will accumulate a significant portion of USDC. If the `pool` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences to the project as a whole.

Centralization Issue on `swapExactTokensForTokensSupportingFeeOnTransferTokens()`

The condition `!_isExcluded[sender] && !_isExcluded[recipient]` can be included in `else` .

Redundant code

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Decentralized ETF 

interfaces

IDetf.sol

GovernorProxy.sol

ITokenTimelock.sol

Pool.sol

Governor.sol

IUniswap.sol

contracts

DetfReflect.sol

Detf.sol

GovernorStorage.sol

IERC20Detailed.sol

utils

Timelock.sol

GovernorEvents.sol

From DeFi to scam awareness, this site arms beginners with the tools they need to thrive in crypto - Cointelegraph

DeFi auditor nets $40,000 for identifying Uniswap vulnerability

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

DeFi Analyst Predicts $2.00 Per Token For Both Uniglo.io And Ripple In 2023 | NewsBTC

3 reasons why it could be a rocky week for Bitcoin, Ethereum and altcoins

Ethereum rallies to $1,350, but derivatives metrics remain neutral to bearish

DeFi Exchange Mango's $114M Exploit Was 'Market Manipulation,' Not a Hack, Ex-FBI Special Agent Says

Bitcoin, Ethereum, Crypto News and Price Data - CoinDesk

Disney hiring transaction lawyer for ‘aggressive’ NFT and DeFi plans

How Ethereum based BudBlockz (BLUNT) Unites the Crypto and Marijuana Industries | NewsBTC

Gibraltar Will Focus on Stablecoins and DeFi Lending After Market Turmoil

FTX.US seems to have paused withdrawals on Ethereum hours after filing for bankruptcy

SHIB Flips SOL by Market Cap, Solana Projects Likely to Move to Ethereum: Crypto Expert

"Ethereum Killer" Solana's Top Spot Threatened by FTX Drama and Emergence of Strong Opponent

Most Hyped Cardano NFT Project Co-Signed by Legendary Ethereum Club

Brett Harrison raises $5 million for DeFi platform aimed at institutions: Bloomberg

Hacker Exploits BNB Chain-Based DeFi Protocol Ankr

Decentralized ETF

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

9

0

7

2

0