Read the findings of the 2022 Web3 Security Report

In the contract `FCTToken` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, change the configuration of this contract, and transfer tokens in the contract.
![](https://accelerator-tasks-prod.s3.amazonaws.com/039bef1a456d40349043dcb5fb2aa71e/diagrams/centralization_FCTToken__owner.svg)

Round 2

The team updated the modifier from `onlyOwner` to `onlyDesigneeToken`, and we do not know the implementation of the new modifier.

Centralization Risks in FCT.sol

In the contract `FGTToken` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, change the configuration of this contract, and transfer tokens in the contract.
![](https://accelerator-tasks-prod.s3.amazonaws.com/039bef1a456d40349043dcb5fb2aa71e/diagrams/centralization_FGTToken__owner.svg)

Round 2

The team updated the modifier from `onlyOwner` to `onlyDesigneeToken`, and we do not know the implementation of the new modifier.

Centralization Risks in FGT.sol

The call on the `swapExactTokensForTokens` function of the contract `FCTToken` will fail due to the receiver, i.e. `FCT`, being one of the `token0` and `token1` for the `FCT-USDT` pair, as a result, it fails to pass below check in the `swap` function of the UniswapV2Pair and be blocked and will be reverted.

The call on the `swapExactTokensForTokens` function of the contract `FGTToken` will fail due to the receiver, i.e. `FGT`, being one of the `token0` and `token1` for the `FGT-USDT` pair, as a result, it fails to pass below check in the `swap` function of the UniswapV2Pair and be blocked and will be reverted.

```solidity
  require(to != _token0 && to != _token1, 'UniswapV2: INVALID_TO');
```
Reference: https://github.com/Uniswap/v2-core/blob/4dd59067c76dea4a0e8e4bfdda41877a6b16dedc/contracts/UniswapV2Pair.sol#L169

Wrong receiver of  the `swapExactTokensForTokens` function

All of the FCT/FGT tokens are sent to the owner of the contract when deploying the contract. This could be a centralization risk as the deployer can distribute FCT/FGT tokens without obtaining the consensus of the community.

Initial Token Distribution

```solidity
        pancakeRouter.addLiquidity(
            address(this),
            usdtAddress,
            tokenAmount,
            usdtAmount,
            0, // slippage is unavoidable
            0, // slippage is unavoidable
            owner,
            block.timestamp + 360
        );
```

The `addLiquidityForUSDT` function calls the `pancakeRouter.addLiquidity` function with the `to` address specified as `owner` for acquiring the generated LP tokens from the `FCT-USDT`/`FGT-USDT` pool. As a result, over time the `owner` address will accumulate a significant portion of LP tokens. If the `owner` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences for the project as a whole.

Round 2

The team use `IParameterConfig.LPReceiver()` instead of `owner()` to receive the lp tokens, and we do not know the implementation of the `IParameterConfig.LPReceiver()`.


Centralized risk in `addLiquidity`

In the function `swapTokensForUSDT` of the contract `FCTToken` and `FGTToken`, there is a missing call on `_approve` to approve the `tokenAmount` amount of the contract tokens as allowances of `pancakeRouter`.
Although the contract approves the allowance for `pancakeRouter` as a large number when deploying, it will still be used up at some point in the future. The call on `pancakeRouter.swapExactTokensForTokens` will fail after the allowance of `pancakeRouter` is reduced to 0.

```solidity
  TransferHelper.safeTransferFrom(
      path[0], msg.sender, UniswapV2Library.pairFor(factory, path[0], path[1]), amounts[0]
  );
```
Reference: https://github.com/Uniswap/v2-periphery/blob/2efa12e0f2d808d9b49737927f0e416fafa5af68/contracts/UniswapV2Router02.sol#L233-L235

In the function `addLiquidityForUSDT` of the contract `FCTToken` and `FGTToken`, there is a missing call on `_approve` to approve the `usdtAmount` amount of the USDT as allowances of `pancakeRouter`.
The call on `pancakeRouter.addLiquidity` will fail because the USDT allowances of `pancakeRouter` are 0.

In the function `addLiquidityForUSDT` of the contract `FCTToken` and `FGTToken`, there is a missing call on `_approve` to approve the `tokenAmount` amount of the contract tokens as allowances of `pancakeRouter`.
Although the contract approves the allowance for `pancakeRouter` as a large number when deploying, it will still be used up at some point in the future. The call on `pancakeRouter.addLiquidity` will fail after the allowance of `pancakeRouter` is reduced to 0.

```solidity
  TransferHelper.safeTransferFrom(tokenA, msg.sender, pair, amountA);
  TransferHelper.safeTransferFrom(tokenB, msg.sender, pair, amountB);
```
Reference: https://github.com/Uniswap/v2-periphery/blob/2efa12e0f2d808d9b49737927f0e416fafa5af68/contracts/UniswapV2Router02.sol#L73-L74


Lack of approve tokens

The contract is serving as the underlying entity to interact with third-party PancakeRouter protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies of `IPancakeRouter02`

The contract is serving as the underlying entity to interact with third-party ParameterConfig protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies of `IParameterConfig`

Two addresses `routerAddress`, `usdtAddress` are on the testnet, not on the mainnet.

Addresses On the Testnet

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The return values of function `addLiquidity` are not properly handled.
```solidity=
        pancakeRouter.addLiquidity(
            address(this),
            usdtAddress,
            tokenAmount,
            usdtAmount,
            0, // slippage is unavoidable
            0, // slippage is unavoidable
            owner,
            block.timestamp + 360
        );
```

Return value not handled

The imported source file `../auth/Auth.sol` is unknown.

The implementations of the modifiers `onlyOwner` and `onlyDesigneeAddress` are unknown.

Unknown Imported Source File

Fistiana

FCT.sol

FGT.sol

Fistiana 

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Did Mark Zuckerberg’s Little Dance Actually Show Us Real Metaverse Legs? | Transparent NEWS

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

Apple Wants to Play in the Metaverse. Don't Expect It to Be Easy.

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

An auditor in the metaverse. No proper tracking of cash or employees. New FTX CEO describes Sam Bankman-Fried’s haphazard management.

Cardano Founder Makes Staggering Prediction about BTC, XRP May Make Everyone Cry, SHIB Metaverse Team Reveals Crucial Update: Crypto News Digest by U.Today

Fistiana

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

13

0

8

1

4