Read the findings of the 2022 Web3 Security Report

In the contract, `BStratX`, the role, `adminAddress`, has authority over the functions shown in the diagram below.

- `pause()`/`unpause()`, to pause/unpause this contract.
- `setRouter0()`, to set DEX router paths to swap BSW for LP token0.
- `setRouter1()`, to set DEX router paths to swap BSW for LP token1.
- `setRouter2()`, to set DEX router paths to swap BSW for Mars token.
- `setBurnRate()`.
- `setbuyBackRate()`.
- `setGov()`, to set the governance contract address.
- `setSwapSlippageBP()`, to set the DEX swap slippage base point.
- `inCaseTokensGetStuck()`, to withdraw locked tokens in this contract, except BSW, LP token0, LP token1, BSW/LP, Mars.

Any compromise to the `adminAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3e0c15ea60c74e03802dc07aa8c0afc7/BStratX-adminAddress.svg)

Centralization Risk in BStratX.sol

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The libraries `ForceSend` and `console` are never used within the project and thus can be removed.

Unused Library

The function `_earn()` will update the farm pool's last earn block to the `block.number`. It repeatedly calls the following function in the linked lines, which can be simplified to call this function in the line 291 once only.

```solidity=351
    IMarsAutoFarm(marsAutoFarmAddress).updateLastEarnBlock(marsPid);
```


Code Simplify

It is not necessary to `delete` an array before assignment.

Redundant Deletion of Array Before Assignment

The linked functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 

Function Visibility Optimization

The contract is serving as the underlying entity to interact with third party Pancake, Biswap protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

In addition, in case the function call `IERC20(wantAddress).safeTransferFrom()` does not check the token transfer return boolean value, the `wantAddress` does not transfer token to the strategy contract successfully, but the `MarsAutoFarm` contract still add shares for user.

Third Party Dependencies

The white spaces in token name and code are not needed.

```solidity=17
    constructor(address _newMarsDAOToken) public ERC20(" GMARSDAO", " GMARSDAO")  {
        newMarsDAOToken=IERC20(_newMarsDAOToken);
    }
```

Unnecessary White Space In Token Name

The user can burn Mars DAO token to mint the Governance token in the contract `GovernanceMarsDAO`. However, the contract does not have a public function for the user to exchange Governance token back to Mars DAO token.

Exchange Governance Token to Mars DAO Token

In the contract, `MarsAutoFarm`, the role, `_owner`, has authority over the functions shown in the diagram below.

- `add()`, to add new pool. The owner can specify any `strategy` contract for the pool.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3e0c15ea60c74e03802dc07aa8c0afc7/MarsAutoFarm-_owner.svg)

Centralization Risk in MarsAutoFarm.sol

The variable `i` in the following loop is defaulted to zero, which can be initiated to 1 to optimize the loop.

```solidity=107
    function getStratThatNeedsEarnings() external view returns(address,uint256){
        uint256 _i=0;
        for(uint256 i;i<poolInfo.length;i++){
            if(poolInfo[i].lastEarnBlock<poolInfo[_i].lastEarnBlock){
                _i=i;
            }
        }
        return (poolInfo[_i].strat,poolInfo[_i].lastEarnBlock);
    }
```


Loop Optimization

The function `getStratThatNeedsEarnings()` is missing a sanity check to ensure the `poolInfo.length` is not zero.

Lack of Sanity Check

The linked functions are missing a sanity check to ensure the input `_pid` is valid.

Lack of Input Validation

The user cannot get all his rewards if he withdraws tokens without calling `earn()` function, because there still have a certain amount of rewards has not been farmed and added to the variable `wantLockedTotal`.

Claim Rewards Before Withdraw

SafeMath from OpenZeppelin is not used in the following functions, which makes them possible for overflow/underflow and will lead to an inaccurate calculation result.

- `castVote()`
- `state()`

SafeMath Not Used

The proposal's state is `Failed` if the total votes not exceed the `QUORUM_VOTES` or the `YES` votes are less than `NO` votes after the deadline. However, the function `state()` returns `Unknown` state after the `proposal.readyToExecutionTime`.

```solidity=274
function state(uint256 proposalId) public view returns (ProposalState) {
	
	if(proposalId<proposals.length){
		Proposal storage proposal = proposals[proposalId];
		
		if (proposal.deadline > block.timestamp) {
			return ProposalState.Active;
		}
		
		if((proposal.YES+proposal.NO)>=QUORUM_VOTES && proposal.YES>proposal.NO){

			if (proposal.executed) {
				return ProposalState.Executed;
			}

			if(proposal.readyToExecutionTime>block.timestamp){
				return ProposalState.Succeeded;
			}

			if (proposal.cancellationTime > block.timestamp) {
				return ProposalState.ExecutionWaiting;
			}

			return ProposalState.Cancelled;

		}else{
			if(proposal.readyToExecutionTime>block.timestamp){
				return ProposalState.Failed;
			} 
		} 
	}
	
	return ProposalState.Unknown;
}
```

Proposal State is Unknown When Failed

All of the 100,000,000 Ether tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute all tokens without obtaining the consensus of the community.

Initial Token Distribution

In the contract, `StratX`, the role, `adminAddress`, has authority over the functions shown in the diagram below.

- `pause()`/`unpause()`, to pause/unpause this contract.
- `setRouter0()`, to set DEX router paths to swap Cake for LP token0.
- `setRouter1()`, to set DEX router paths to swap Cake for LP token1.
- `setRouter2()`, to set DEX router paths to swap Cake for Mars token.
- `setBurnRate()`.
- `setbuyBackRate()`.
- `setGov()`, to set the governance contract address.
- `setSwapSlippageBP()`, to set the DEX swap slippage base point.
- `inCaseTokensGetStuck()`, to withdraw locked tokens in this contract, except Cake, LP token0, LP token1, Cake/LP, Mars.

Any compromise to the `adminAddress` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/3e0c15ea60c74e03802dc07aa8c0afc7/StratX-adminAddress.svg)

Centralization Risk in StratX.sol

MarsDAO

SafeMath.sol

IERC20.sol

StratX.sol

Address.sol

GovernanceToken.sol

EnumerableSet.sol

MarsDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

18

0

11

2

5