Read the findings of the 2022 Web3 Security Report

The contract is serving as the underlying entity to interact with third party PancakeSwap protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

In the contract `TIGRDAO` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/013f4f8cc8df479fbfac18bbc5ac204f/diagrams/centralization-TIGRDAO-_owner.svg)

Centralization Risk in TIGRDAO.sol

275000001*(10**9) tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

Fees collected in the contract are sent to a hardcoded address. If the private key of those address got compromised, the hacker can sell those tokens and gain profit from it.

Fee Distribution 

The return value of the transfer()/transferFrom() call is not checked.

File: TIGRDAO.sol (Line 1205, Function `TIGRDAO.claimStuckTokens`)
```solidity
        erc20token.transfer(owner(), balance);
```


---
File: TIGRDAO.sol (Line 1400, Function `TIGRDAO.swapAndSendWallets`)
```solidity
        IERC20(BUSD).transfer(_assetWallet, forAsset);
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

TokensIntoLiqudity should be tokensIntoLiquidity in the indicated line.

Typos in the contract

Potential sandwich attacks could happen if calling uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens and uniswapV2Router.swapExactETHForTokensSupportingFeeOnTransferTokens without setting restrictions on slippage.

For example, when we want to make a transaction of swapping 100 AToken for 1 ETH, an attacker could raise the price of ETH by adding AToken into the pool before the transaction so we might only get 0.1 ETH. After the transaction, the attacker would be able to withdraw more than he deposited because the total value of the pool increases by 0.9 ETH.


Potential Sandwich Attacks

`newBalance` firstly multiplies `(totalBuyFee + sellFee.assetFee)`, then divided by `(totalBuyFee + sellFee.assetFee)`, which are the same values. 

Confused Calculation 

The values of `totalBuyFee` and `buyFee.assetFee` are always the same. 

Redundant Statements

We advise the team to change `Buy exceeds limit` to `Sell exceeds limit`. 

TIGR

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

12

0

12

0

0