All of the aRICH tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute aRICH tokens without obtaining the consensus of the community.

Initial Token Distribution

The error message in the `require` statement says "Vesting must be longer than 36 hours", which is inconsistent with the actual requirement of 10000 block time. 

```solidity
require(_input >= 10000, "Vesting must be longer than 36 hours");
```

Inconsistent Comments and Code

The following require statement checks that `totalDebt` before `deposit` does not exceed `maxDebt`

```solidity
require(totalDebt <= terms.maxDebt, "Max capacity reached");
```

However, `totalDebt` is incremented in the same `deposit()` function, and `totalDebt + value` could exceed `maxDebt` after the `deposit()` function is executed. 

```solidity
totalDebt = totalDebt.add(value);
```

`totalDebt` Could Exceed `maxDebt`

The function `_bondPrice()` checks whether the `price_` is less than `terms.minPrice` and make sure the new price is greater than `terms.minPrice`. However, when the `price_` is greater than or equal to `terms.minPrice` at the beginning, the value of `terms.minPrice` is set to 0 making the latter min price checking invalid.


Logic issue in function `_bondPrice()`

In the contract `aRICHMigrations` of the file AlphaRICHMigration.sol, the function `initialize()` lacks a check on the variables `startTimestamp` and `endTimestamp` to ensure that `endTimestamp` is greater than `startTimestamp`

In the contract `RICHPreSale` of the file RICHPreSale.sol, the function `initialize()` lacks checks on the variables `startTimestamp` and `endTimestamp` to ensure that `endTimestamp` is greater than `startTimestamp`.

In the contract `RICHPreSale` of the file RICHPreSale.sol, the function `initialize()` lacks checks on the variables `minAmount` and `maxAmount` to ensure that `maxAmount` is greater than `minAmount`.

Missing Requirements

Flashloan is a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. 

An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit and/or manipulate the token price in the decentralized exchanges. 

We find that the contract `LpBondCalculator` relies on price calculations that are based on-chain, meaning that they would be susceptible to flash-loan attacks by manipulating the price of given pairs to the attacker's benefit. 

Potential Flashloan Attack

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

In the contract `aRICHMigration` the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b851c812b45a406bac79cca905ce8845/diagrams/centralization-aRICHMigration-_owner.svg)

In the contract `Policy` the role `_newPolicy` has authority over the function `pullPolicy()`; the role `_policy` has authority over the functions `renouncePolicy()` and `pushPolicy()`;

In the contract `RICHERC20Token`, the role `_vault` has authority over the function `mint()`; the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b851c812b45a406bac79cca905ce8845/diagrams/centralization-RICHERC20Token-_owner.svg)

In the contract `RICHPreSale` the role `_owner` has authority over the functions shown in the diagram below. Additionally, users' USDC used for token purchase are sent to the owner set `DAOAddress`. 

![](https://accelerator-tasks-prod.s3.amazonaws.com/b851c812b45a406bac79cca905ce8845/diagrams/centralization-RICHPreSale-_owner.svg)

In the contract `RICHStaking` the role `locker` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b851c812b45a406bac79cca905ce8845/diagrams/centralization-RICHStaking-locker.svg)

In the contract `VaultOwned` the role `_owner` has authority over the function `setVault()`.

In the contract `USDCERC20Token` the role `_vault` has authority over the function `mint()`.

In the contract `TWAPOracleUpdater` the role `_owner` has authority over the functions shown in the diagram below.

![](https://accelerator-tasks-prod.s3.amazonaws.com/b851c812b45a406bac79cca905ce8845/diagrams/centralization-TWAPOracleUpdater-_owner.svg)

In the contract `Ownable` the role `_newOwner` has authority over the function `pullManagement()`; the role `_owner` has authority over the functions below:
- `renounceManagement()`
- `pushManagement()`
- `renounceOwnership()`
- `transferOwnership()`

In the contract `RedeemHelper` the role `_owner` has authority over the functions listed below:
- `addBondContract()`
- `removeBondContract()`

Any compromise to these privileged accounts may allow the hacker to take advantage of the authority, and withdraw token balance from the contract or change important addresses like the `DAOAddress` to hacker affiliated address.


Centralization Related Risk

The `_newOwner` can regain the ownership of the contract even after calling the function `renounceManagement` to renounce it. This can be achieved by performing the following operations:
1. Call `pushManageMent()` to set the variable `_newOwner` to specified account.
2. Call `pullManagement()` to gain ownership, `_owner` and `_newOwner` are now the same address.
3. Call `renounceManagement()` to set `_owner` to `address(0)`. 
4. Call `pullManagement()` to regain ownership as `_newOwner` is still a valid address.

`newOwner` Can Regain Ownership 

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

Missing Zero Address Validation

Implementation of the interface `ITWAPOracle` in the `USDC` contract, and the implementation of the interface `IDepositor` in the `DepositHelper` contract are unknown.

The scope of the audit treats contract that is out of scope, unknown implementation of interfaces, and other dependencies as black boxes and assumes their functional correctness. However, in the real world, these out of scope contracts can be compromised, potentially causing major vulnerability for the project. 

Unknown Implementation of Interface

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The return values of external calls are not stored in local or state variables.

Unused Return Value

The `initialize()` function in the `RICHPreSale` contract can be called multiple times by the owner. 

`initialize()` Can Be Called Multiple Times

In the function `_storeRebase()`, the variable `profit_` is divided by `previousCirculating_` which may be zero. Because in the `initialize()` function, all the initial supply are given to the `stakingContract` account, the `circulatingSupply()` function will return 0.

```solidity=1100
uint rebasePercent = profit_.mul(1e18).div( previousCirculating_ );
```

Potential Divide by Zero

The maximum value of `ReserveToken` that an approved debtor can borrow is equal to the account's balance of `sRICH` token.

The assets in `Treasury` may suffer a loss in the following scenarios: 
1. The `sRICH` tokens can be transferred to anybody else, let's say user A has 100 `sRICH` tokens and he borrows 100 `ReserveToken`. Then A transfers these `sRICH` tokens to B, then B can also borrow 100 `ReserveToken` and so on and so forth.
2. A Debtor can:
    - call `incurDebt()` to borrow `ReserveToken`.
    - then call `BondDepository.deposit()` to get `RICH` tokens.
    - then call `Staking.stake()` to stake these `RICH` tokens and wait to call `Staking.claim()` to get `sRICH` tokens.
   
   The debtor's `sRICH` balance increases, so he can repeat the above function calls.

Logical Issues in Function `incurDebt()`

In the function `mintRewards()` of contract `Treasury`, the reward managers can mint arbitrary amount of the reward `RICH` token to any arbitrary addresses.

Centralization Related Risk in Reward Managers

In function `incurDebt()`:
```solidity
        IERC20(_token).transfer(msg.sender, _amount);
```

Unchecked ERC-20 `transfer()`

In the `deposit()` function of contract `Treasury`, both the reserve and liquidity token can be deposited. But in L412 of function `withdraw()`, there is a `require` statement only allowing withdrawing reserve tokens. No withdrawal method is provided in this contract to withdraw the liquidity token.

Liquidity token cannot be withdrawn

A user can call `deposit()` to deposit ETH for "USDC Test" tokens. However, the contract does not provide a way to withdraw these ETH.

Non-Withdrawable ETH

RichDAO

projects

contracts

StakingWarmup.sol

AlphaRICH.sol

AlphaRICHMigration.sol

RICHPreSale.sol

StakingDistributor.sol

mocks

PancakeRouter.sol

BondHelper_lp.sol

PancakeFactory.sol

Treasury.sol

BondDepository.sol

Staking.sol

LpBondCalculator.sol

StakingHelper.sol

RedeemHelper.sol

RICHERC20.sol

USDC.sol

sRICHERC20.sol

RichDAO 

DeFi Protocol Yearn Finance's Token Rises 7% Despite Market Plunge

This DeFi Protocol Just Got Hacked. Its Token Is Still Doing Better than a Major US Bank's

From DeFi to scam awareness, this site arms beginners with the tools they need to thrive in crypto - Cointelegraph

DeFi auditor nets $40,000 for identifying Uniswap vulnerability

DeFi Analyst Predicts $2.00 Per Token For Both Uniglo.io And Ripple In 2023 | NewsBTC

DeFi Exchange Mango's $114M Exploit Was 'Market Manipulation,' Not a Hack, Ex-FBI Special Agent Says

Disney hiring transaction lawyer for ‘aggressive’ NFT and DeFi plans

Gibraltar Will Focus on Stablecoins and DeFi Lending After Market Turmoil

Brett Harrison raises $5 million for DeFi platform aimed at institutions: Bloomberg

Hacker Exploits BNB Chain-Based DeFi Protocol Ankr

BlockTower Capital Crypto Asset Management Firm Loses $1.5M in DeFi Market Aggregator Dexible Exploit: Blockchain Data

DeFi protocol Archimedes raises $4.9 million in seed funding

USDC Trading Dominates Record Day for DeFi Exchanges Uniswap, Curve

DeFi-Focused Startup Blue Comes Out of Stealth With $3.2M Raise

Coinbase Is Adding DeFi Apps Uniswap and Aave to Its Base Blockchain: Source

Presales Like Uniglo.io (GLO) Are Generating Demand As Ethereum (ETH) Merge Looks To Benefit DeFi And UniSwap (UNI) | NewsBTC

Biggest Upset in DeFi: TMS Network (TMSN) Upends dYdX (DYDX) and Uniswap (UNI) as the Most Popular DEX | NewsBTC

From neglecting security to bad tokenomics, DeFi has played a hand in its own decline

2023 Investment Guide: DeFi Giants Celsius Network (CEL) and Aave (AAVE) | Bitcoinist.com

Nasdaq's Crypto Move, $160M DeFi Hack, Hong Kong CBDC + More News

Coinbase CEO: Regulate centralized actors but leave DeFi alone

RichDAO  Token

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

RichDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

20

0

20

0

0

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

We're Hiring

Disclaimer

Resources

RichDAO

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

20

0

20

0

0