In the contract `HyperToken` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-HyperToken-_owner.svg)

---

In the contract `FundManagerAlgo` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-FundManagerAlgo-_owner.svg)

In the contract `FundManagerRace` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-FundManagerRace-_owner.svg)

In the contract `FundManagerFixed` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-FundManagerFixed-_owner.svg)

---

In the contract `MasterChef` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-MasterChef-_owner.svg)

In the contract `MasterChef` the role `devaddr` has authority over the functions shown in the diagram below.

Any compromise to the `devaddr` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-MasterChef-devaddr.svg)

In the contract `MasterChef` the role `feeAddress` has authority over the functions shown in the diagram below.

Any compromise to the `feeAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7fffbc9b9a0b4bf49eae26e475d41ccb/diagrams/centralization-MasterChef-feeAddress.svg)

---

```solidity=528
function extractToken(IBEP20 _asset, address _to, uint256 _amount) external onlyOwner nonReentrant {
    _asset.safeTransfer(_to, _amount);
}
```

The `extractToken()` function can transfer all the tokens to any address by the `onlyOwner`. As a result, invocation of `_asset.safeTransfer(_to, _amount)` in function `extractToken()` may bring dangerous effects as it is unknown to the user. However, the project may lose the ability to upgrade and migrate if `extractToken()` is removed.

---

The `updatePool()` method in all three `FundManager` contracts can affect the user's investment returns, taking the `FundManager_Algo.sol` contract as an example.
```solidity
function updateCube(uint256 _cubeId, uint256 _totalAssetAmount, bool _availUpdate) external onlyOwner { 
    CubeInfo storage cube = cubeInfo[_cubeId];
    if (block.number <= cube.times.lastUpdateBlock) {
        return;
    }
    cube.totals.assetAmount = _totalAssetAmount;
    if (cube.totals.shares != 0) {
        cube.sharePrice = cube.totals.assetAmount.mul(1e12).div(cube.totals.shares);
    }
    cube.times.lastUpdateBlock = block.number;
    if (_availUpdate) {
        cube.totals.lastAvailUpdate = block.timestamp;
    }
}
```

Since the `_totalAssetAmount` value is not verified, the `cube.sharePrice` can be any value. In the `getActualProfit()` method, the profit and loss are calculated by comparing `cube.sharePrice` with `user.price`.

In one word, the owner can directly decide the profit and loss of the invested user by modifying the `cube.shareprice`.

Centralization Related Risks

`HyperDex` is an all-in-one investment platform built for everyone. It contains many common features: 
- `HyperToken` is a BEP20 token with governance features like `COMP`.
- `MasterChefV2` is a farm contract like `pancake` that allows users to reward hyperToken by staking lp tokens.
- `FundManager` is a set of investment contracts where investors can invest specific BEP20 assets as well as hyperToken to get various rewards.

But in combination with the code and the white paper, the whole economic model is not very well developed.

- hyperToken, as a governance coin, lacks a concrete governance implementation, similar to the Compound project's `GovernorBravoDelegate` contract.

- The code lacks a whitepaper describing the distribution scheme for HyperToken, and it is reasonable to set a total amount for HyperToken as a reward coin.

- In these `FundManager` contracts, specific BEP20 tokens are transferred to `managedAddress`, and the subsequent investment strategy for these BEP20 tokens is not clear.

- The need for hyperToken prices in the `FundManager` contracts via hyperTokenPricePair means that the project owner needs to maintain liquidity for the corresponding pairs in the pancake trading pool.

Financial Models

The contract is serving as the underlying entity to interact with third-party `AggregatorV3Interface`, `hyperTokenPricePair` protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

In the whitePaper, we can see that `To increase overall returns, normal Trading Cubes may be upgraded to HyperCubes. This is done by depositing an additional 10-100% of the original investment in HYP tokens.` 

So in the three FundManager contracts, the parameter `minHyperTokenRatioBP` shouldn't be less than 1000 once it is not 0.

Lack input validation On `minHyperTokenRatioBP` 

In all three FundManager contracts, the method `getActualProfit()` is used to query the user's investment return. Take the FundManager_Algo contract as an example.

According to the description on the project white paper, when the number of hyperToken is 0, the investor only has the corresponding return of the specific BEP20 asset invested, when the number of hyperToken is greater than 0, normal Algo Trading Cubes may be upgraded to HyperCubes, the investor can get a higher compound returns.

```solidity=674
if (user.hyperTokenAmount == 0) {
  localProfitInfo.profitDetail.hyperTokenProfitBonus = localProfitInfo.profitDetail.assetProfit.mul(localProfitInfo.assetPriceUSD).mul(user.bonusRewardBP.add(user.referralBonusBP)).div(localProfitInfo.hyperTokenPrice).div(10000);
}
```
So for the above code, it is puzzling, in the hyperToken number is equal to 0, the investing user can still get HyperToken gain, this gain is a profitable basis is a profit of investing in BEP20 assets.


Discussion on `getActualProfit()`

There's no sanity check to validate if a cube is existing.

Recommended Explicit Cube Validity Checks

The latter condition of the if statement is redundant since the judgment is on the ratio of the two asset amounts of this investment.

```solidity=423
if (_hyperTokenAmount != 0 || user.avgHyperSecond != 0) {
  uint256 ratioBP = _hyperTokenAmount.mul(hyperTokenPrice).mul(10000).div(_amount).div(assetPriceUSD);
  require(ratioBP >= cube.fees.minHyperTokenRatioBP, "E044"); // invest: hyperTokenAmount under minimum
  require(ratioBP <= cube.fees.maxHyperTokenRatioBP, "E045"); // invest: hyperTokenAmount over maximum
}
```

The condition `user.avgHyperSecond != 0` means that if there is a previous investment by the user in the current cube, then all subsequent single-asset investments by the user will fail.

Redundant Condition

In the `invest()` function, the investor transfers the BEP20 asset specified by the cube to the `managedAddress`.

```solidity=460
cube.asset.safeTransferFrom(address(msg.sender), cube.managedAddress, _amount); // FundManager_Algo.sol
```

But when the user withdraws the investment assets, they are transferred from the current contract address.

```solidity=621
cube.asset.safeTransfer(address(msg.sender), withdrawAmount[2]); // FundManager_Algo.sol
```

However, in the contract code, we do not see the process of transferring BEP20 assets from `managedAddress` to the current contract, so there is a risk of insufficient BEP20 when the user withdraws the investment assets.

Insufficient invest token to withdraw

The function `getTwapPrice()` is to get the price of the BEP20 asset specified by the cube. But this function is not implemented in the audit scope.

Unknown Implementation of `getTwapPrice()`

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

In the following `if` statement, this condition `address(_referral) == _referral` is redundant:
```solidity=416
if (!user.referralUsed && address(_referral) == _referral && _referral != address(0) && cube.fees.referralBonusBP != 0) {
```

Redundant Check

The MasterChefV2 contract operates as the main entry for interaction with staking users. The staking users deposit LP tokens into the Hyperdex pool and in return get a proportionate share of the pool’s rewards. Later on, the staking users can withdraw their own assets from the pool. In this procedure, `deposit()` and `withdraw()` are involved in transferring users’ assets into (or out of) the Hyperdex protocol. When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged (and burned) transaction fee. As a result, this may not meet the assumption behind these low-level asset-transferring routines and will bring unexpected balance inconsistencies.


Incompatibility With Deflationary Tokens

`updatePool()` function minted 100% + 10% (dev fee is included as 10% of the 100%) of total rewards.

Over minted token

Hyperdex

FundManager_Algo.sol

FundManager_Fixed.sol

HyperDEX

MasterChefV2.sol

projects

HyperToken.sol

FundManager_Race.sol

HyperDex

Binance CEO, Coinbase exec feature in Masterclass crypto crash-course

Binance proof-of-reserves audit shows BTC is overcollaterised

CryptoQuant gives Binance clean bill of health

Binance Cuts Ties with WazirX, Cancels Its Wallet Service

TrueFi (TRU) up 64%, Here's Why and What Binance Had to Do With It

Binance Coin Price Prediction as BNB Pumps Up 17% in a Week – Time to Buy?

Binance receives green light for crypto services in Dubai

Bitcoin Withdrawals to Be Temporarily Suspended on Binance on This Date

Binance Continues Market Dominance with Massive Bitcoin Spot Trading Volume

Binance Announces New Transaction Limit By Fiat Partner, What Could This Mean For BNB?

FTX Token price risks 30% plunge as a 23M FTT 'part' moves to Binance - Crypto Capital Today

Hundreds of Millions of XRP Moved from Binance, Here's What Happened Here

Mazars halts work for crypto firms including Binance

Binance Coin Shows Weakness As Price Sits On Key Support; Is $200 Possible?

Binance intends to acquire Bankman-Fried's FTX amid 'significant liquidity crunch'

Binance Dominates Bitcoin And Crypto Market Like Mt. Gox Once Did: Research

Crypto Exchange Binance to Suspend US Dollar Bank Transfers This Week

Sam Bankman-Fried Apologises, Tells Binance ‘You Won’

Bitcoin Worth $2 Billion Transferred from Binance on Market Dip

Binance to bring fans closer to sports teams with fan token platform

FTX’s ETH Reserves Drop to the Lowest Level Since November 2020 After Binance Begins Dumping all FTX Tokens on its Books

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

HyperDex

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

6

1

7

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

We're Hiring

Disclaimer

Resources

HyperDex

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

14

0

6

1

7