Read the findings of the 2022 Web3 Security Report

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing emit events

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

In the contract, `Fairy`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/05c6d227f3b249389bc461c0d4a20cdf/Fairy-_owner.svg)

------

In the contract, `Fairy`, the role, `_minters`, has the authority over the functions as below list.

- `mint()` - Mint `_amount` tokens to any specified address.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

Centralization Risk in Fairy.sol

Fairyswap Token

Fairy.sol

Unlocked compiler version

In the contract, `FairyFactory`, the role, `feeToSetter`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `feeToSetter` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b4fdc4f9aeab4f289f70263210abde7d/FairyFactory-feeToSetter.svg)

Centralization Risk in FairyFactory.sol

The liquidity calculation is 1/6th in the comment, but not in the code. The liquidity value should be included in the white paper and the customer should know what it is.

Comment is inconsistent with code

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing error messages

In the contract, `MasterChef`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b4fdc4f9aeab4f289f70263210abde7d/MasterChef-_owner.svg)

Centralization Risk in MasterChef.sol

The comment in line L67, mentioned // XXX DO NOT add the same LP token more than once. Rewards will be messed up if you do.

The total amount of reward in function `updatePool()` will be incorrectly calculated if the same LP token is added into the pool more than once in function `add()`.

However, the code is not reflected in the comment behaviors as there isn’t any valid restriction on preventing this issue.

The current implementation is relying on the trust of the owner to avoid repeatedly adding the same LP token to the pool, as the function will only be called by the owner.

add() Function Not Restricted

There's no sanity check to validate if a pool is existing.

Recommended Explicit Pool Validity Checks

In the current version `0.6.12`, the result of the calculation `0 - 1`, will get the max value. But if the version is higher than `0.8.0`, there will throw an exception.

The problem of calculation

The order of external `call/transfer` and storage manipulation must follow the `check-effect-interaction` pattern.

Check Effect Interaction Pattern Violated

In the contract, `SmartChef`, the role, `_owner`, has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b4fdc4f9aeab4f289f70263210abde7d/SmartChef-_owner.svg)

Centralization Risk in SmartChef.sol

Fairyswap

SmartChef.sol

contracts

FairySwap

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

8

0

3