Forgotten Coin - Smart Contract Audit Report

Summary

Forgotten ICO Forgotten Chain is building a new MMORPG. The game's native token ("FTC") is claimed to be used for purchasing items in-game, swap for NFTs, repair damaged items, purchase mounts, pets and more. The Forgotten token will be deployed to the Binance Smart Chain. For the purpose of this audit we reviewed the Token, Crowdsale, and Vesting Contracts.

We reviewed the team's Token, Vesting, and Crowdsale contracts at commit 703bbaa9aa7f9599b440e9724bf411071ee7fcf6 on GitHub.

Notes on the Forgotten Token Contract:
The token is not currently deployed to the BSC Mainnet.
The Forgotten Token's total supply is determined upon deployment and the tokens are granted to the owner.
The Forgotten Token Crowdsale contract indicates that the total supply should be 5 Billion tokens, so the deployer must be careful to ensure this amount is accurately set.
No mint or burn functions are accessible after deployment; though the circulating supply can be reduced by sending tokens to the 0x..dead address, if desired.
Although the contract inherits the ownable contract, there are no ownership restricted functions present within the token contract.
The contract complies with the BEP20 Token Standard.
The contract utilizes SafeMath libraries to prevent overflows.

Notes on the Forgotten Token Crowdsale Contract:
This contract allows users to contribute BNB to purchase Forgotten Tokens that will vest to them at a later date. During this sale, up to 10% of the total token supply can be purchased across all participants.
Forgotten tokens are denominated in BNB, and the exchange rate will be set by the team upon deployment.
If the Crowdsale is unpaused, participants can send BNB to the ‘Forgotten Crowdsale Contract’ which will automatically “buyTokens” on their behalf.
When a participant purchases tokens during the crowdsale, they will become beneficiaries of a separate vesting contract that is created at the end of the sale.
There are three possible stages of the sale: "PreICO", "ICO", and "PostICO". The owner has the ability to modify the ICO stage (at any time if they desire), and the stage determines the features that are available for crowd sale participants.
During the PreICO stage, up to 3% of the total token supply can be purchased by various participants. The stage will automatically increment to the ‘ICO’ stage during the transaction that causes the total tokens purchased to surpass this 3% total token supply. When this occurs, the contract will be “paused”, and must be unpaused by the owner.
During the ICO stage, up to 10% of the total token supply can be purchased by various participants. The stage will automatically increment to the ‘PostICO’ stage during the transaction that causes the total tokens purchased to surpass this 10% total token supply. When this occurs, the contract will be “paused”.
During the PostICO stage, users cannot buy tokens with this contract, as the crowd sale has ended.
When the crowd sale is in the PostICO stage, the owner is able to “Distribute Tokens” from the contract. This will immediately transfer 500,000,000 Forgotten tokens (10% of the total supply) to the team’s “Liquidity and Marketing Fund”, and then generates the token vesting contracts for various funds set up by the team.
'FoundationEscrow1' will be vested 50,000,000 tokens (1% total supply) over a 300 day period.
'FoundationEscrow2' will be vested 450,000,000 tokens (9% total supply) over a 540 day period.
The "Token Vesting Pool" contract is automatically created for those that participated in the crowd sale. The token vesting pool contract will create an individual vesting contract for each beneficiary who purchased tokens during the sale. These tokens will vest to their respective beneficiaries over a period of 600 days.
'GameEscrow' will be vested the remaining unsold tokens (this will range from 70% to 80% of the total supply) over a 2555 day period.
This “Distribute Tokens” function can only be called once, and it must be called by the owner.
The contract will be compiled with Solidity version 0.8.0 (or above) which will prevent any possible overflow issues.

Ownership Controls:
The owner has the ability to pause and unpause the Crowdsale contract at any time. When paused, participants can not buy tokens through the Crowdsale contract.
The owner has the ability to manually update the stage of the ICO to any of the 3 stages (PreICO, ICO, and PostICO) at any time.
The owner has the ability to update the rate of tokens that are issued per BNB at any time.
The owner has the ability to manually add a beneficiary to the vesting pool.
The owner has the ability to call the distributeTokens function only one time.
The owner has the ability to send the BNB raised during the sale from the contract address to a wallet that is specified upon deployment.

Audit Findings Summary
No issues from external attackers were identified.
As with any presale, ensure trust in the team prior to investing.
Further, ensure trust in the team as they have substantial control in the ecosystem.
Date: October 2nd, 2021
Updated: October 6th, 2021 to correct a critical issue resulting in multiplication of presale participant funds.
Updated: December 29th, 2021 to rename the token.

External Threat Results

Vulnerability Category	Notes	Result
Arbitrary Storage Write	N/A	PASS
Arbitrary Jump	N/A	PASS
Delegate Call to Untrusted Contract	N/A	PASS
Dependence on Predictable Variables	N/A	PASS
Deprecated Opcodes	N/A	PASS
Ether Thief	N/A	PASS
Exceptions	N/A	PASS
External Calls	N/A	PASS
Logical Issues	N/A	PASS
Integer Over/Underflow	N/A	PASS
Multiple Sends	N/A	PASS
Suicide	N/A	PASS
State Change External Calls	N/A	PASS
Unchecked Retval	N/A	PASS
User Supplied Assertion	N/A	PASS
Critical Solidity Compiler	N/A	PASS
Overall Contract Safety		PASS

FTCToken Contract - Details

Contract Graph

Multi-file Token


 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
 + [Lib] SafeMath 
    - [Int] tryAdd
    - [Int] trySub
    - [Int] tryMul
    - [Int] tryDiv
    - [Int] tryMod
    - [Int] add
    - [Int] sub
    - [Int] mul
    - [Int] div
    - [Int] mod
    - [Int] sub
    - [Int] div
    - [Int] mod

 + [Int] IERC20 
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Int] IERC20Metadata (IERC20)
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 +  ERC20 (Context, IERC20, IERC20Metadata)
    - [Pub]  #
    - [Pub] name
    - [Pub] symbol
    - [Pub] decimals
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Int] _transfer #
    - [Int] _mint #
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _beforeTokenTransfer #
    - [Int] _afterTokenTransfer #

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Prv] _setOwner #

 +  FTCToken (ERC20, Ownable)
    - [Pub]  #
       - modifiers: ERC20

FTCTokenCrowdsale Contract - Details