Read the findings of the 2022 Web3 Security Report

In the contract `RelationImpl`, the role `KOwnerOnly` has authority over the functions below.
- `setToken()` - Set the token which can judge whether the recommender is satisfied.
- `setBase()` - Set the limit to be recommender
- `takeOutTokenInCase()` - Claim the reward in this contract.

Any compromise to the `KOwnerOnly` account may allow the hacker to take advantage of this authority.

---

In the contract `MasterChef` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/f2657c0e0bb0412b8d7c2b9302201611/diagrams/centralization-MasterChef-_owner.svg)

---

In the contract `EarnHolder` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/f2657c0e0bb0412b8d7c2b9302201611/diagrams/centralization-EarnHolder-_owner.svg)

In the contract `EarnHolder` the role `auth` has authority over the functions shown in the diagram below.

Any compromise to the `auth` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/f2657c0e0bb0412b8d7c2b9302201611/diagrams/centralization-EarnHolder-auth.svg)

---

In the contract `FSwapFactory` the role `feeToSetter` has authority over the functions shown in the diagram below.

Any compromise to the `feeToSetter` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/f2657c0e0bb0412b8d7c2b9302201611/diagrams/centralization-FSwapFactory-feeToSetter.svg)

Centralization Risk

Multiple Solidity versions are used in the codebase.

Versions used: `=0.5.16`, `>=0.5.0`, `=0.6.12`,`>=0.6.2`, `=0.6.6`, `>=0.6.6<0.8.0`

File: FSwap/f-swap-core/contracts/FSwapPair.sol (Line 1)
```solidity
pragma solidity =0.5.16;
```

File: FSwap/f-swap-core/contracts/interfaces/IFSwapFactory.sol (Line 1)
```solidity
pragma solidity >=0.5.0;
```
File: FSwap/f-swap-farm/contracts/interfaces/IBEP20.sol (Line 7)
```solidity
pragma solidity =0.6.12;
```

File: FSwap/f-swap-router/contracts/interfaces/IFSwapRouter01.sol (Line 1)
```solidity
pragma solidity >=0.6.2;
```

File: FSwap/f-swap-router/contracts/libraries/SafeMath.sol (Line 1)
```solidity
pragma solidity =0.6.6;
```

File: FSwap/f-swap-router/contracts/libraries/TransferHelper.sol (Line 3)
```solidity
pragma solidity >=0.6.6 <0.8.0;
```



Different Solidity Versions

Addresses should be checked before assignment or external calls to make sure they are not zero addresses.


Missing Zero Address Validation

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

One or more state variables are used without being initialized in the constructor.

- `pairFee` is never initialized, but used in `getDefFeeTo()`.
- `def_relation` is never initialized, but used in `getRelation()`.


Uninitialized State Variable

In the function `burn()`, if the value of `totalSupply` is 0, the following two division operations will fail due to the divide by 0 error, which ultimately makes the invocation to `burn()` function fail.

```solidity=144
amount0 = liquidity.mul(balance0) / _totalSupply; // using balances ensures pro-rata distribution
amount1 = liquidity.mul(balance1) / _totalSupply; // using balances ensures pro-rata distribution
```

Divide by Zero

The comment of `_mintFee()` function mentioned: `if fee is on, mint liquidity equivalent to 1/6th of the growth in sqrt(k)`. 

Based on the calculation logic below, the liquidity token minted for `feeTo` address is actually `1/4` of the growth in `sqrt(k)`.

```solidity=107
uint rootK = Math.sqrt(uint(_reserve0).mul(_reserve1));
uint rootKLast = Math.sqrt(_kLast);
if (rootK > rootKLast) {
  uint numerator = totalSupply.mul(rootK.sub(rootKLast));
  uint denominator = rootK.mul(3).add(rootKLast);
  uint liquidity = numerator / denominator;
  if (liquidity > 0) _mint(feeTo, liquidity);
}
```

Inconsistency mint fee description

The `setMigrator()` function can set the migrator contract to any contract that is implemented from `IMigratorChef` interface by the owner. As result, the invocation of `migrator.migrate()` in function `migrate()` may be as dangerous as it is unknown to the user. On the other hand, the project could lose the ability to upgrade and migrate if `setMigrator()` and `migrate()` are removed.  

Unknown Implementation of `migrator.migrate()`

Users obtain the reward by staking the LP token. When initializing and modifying the total amount of rewards, the client needs to ensure that the `EarnHolder` contract has enough reward tokens.

Insufficient reward distribution

When the same LP token is added into a pool more than once in function `add()`, the total amount of reward in function `updatePool()` will be incorrectly calculated.  The current implementation is relying on the operation correctness to avoid repeatedly adding the same LP token to the pool, as the function will only be called by the owner.

`add()` Function Not Restricted

There's no sanity check to validate if a pool is existing.

Recommended Explicit Pool Validity Checks

The variable `totalAllocPoint` is declared but never used or updated.

Unused Variable

FSwap

FSwapLibrary.sol

WETH9.sol

FSwap

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

9

0

5