MoonForce

Smart Contract Audit Report

Audit Summary

MoonForce is building a new Presale contract generator and an LP token locking mechanism.

For this audit, we reviewed the following contracts on the Binance Smart Chain Mainnet:

MoonForceLocker contract at 0x412397FeC775d60a8F2489E67692fa3bF32d4807.
PresaleSettings contract at 0x342dcC1cD4e8822297b3B7c53C1864Ecbd988ea8.
PresaleFactory contract at 0xF710DD6BD3414Cd4c569Ba0EDDFA8d3585EBaa9e.
PresaleLockForwarder contract at 0x01bD79A5486091BEe45aDA96AEC93AaCE6A44Fb7.
PresaleGenerator contract at 0x20e21425dFd0dA0F6810542Cdb3127baa9aD9B5e.

Audit Findings

Please ensure trust in the team prior to investing as they have substantial control in the ecosystem.
Date: April 21st, 2022.
Finding #1 - MoonForceLocker - High
Description: A redundant safeApprove() call is performed before transferring the referral fee tokens to the referral address.
TransferHelper.safeApprove(address(gFees.secondaryFeeToken), _referral, referralFee);
TransferHelper.safeTransfer(address(gFees.secondaryFeeToken), _referral, referralFee);
Risk/Impact: The referral address will be able to spend tokens on behalf of the secondaryFeeToken address for the referralFee value.
Recommendation: The above safeApprove() call should be removed from the contract.
Resolution: The team has not yet addressed this issue.
Finding #2 - Presale - Low
Description: The safeTransferBaseToken() function uses the transfer() function instead of the call() function to transfer BNB to users.
Risk/Impact: The transfer() function uses a hardcoded gas amount of 2300, meaning transactions could run out of gas as users receive BNB.
Recommendation: Use .call.value{...}("") instead as it does not have a gas limitation.
Resolution: The team has not yet addressed this issue.

Contracts Overview

The contracts utilize ReentrancyGuard to prevent against reentrancy attacks in applicable functions.
The contracts utilize the SafeMath library to protect from any possible overflows/underflows.
MoonForceLocker Contract:
Any user may use this contract to lock a valid Pancakeswap V2 LP token. Tokens may not be withdrawn until a specified time has passed.
Users specify a lock "owner" which is the recipient for the locked LP Tokens.
Users must pay either a BNB fee or a secondary fee in the form of the secondary token set by the team.
If the fee is in BNB, the collected BNB is sent to the team's Dev address.
If the fee is in the secondary token, the collected tokens are burned in the token contract.
If a referral address was passed in and the referral token is set, the balance of the referral address must be greater than or equal to the minimum referral hold value set by the team.
Users who enter a valid Referral address are eligible for a fee discount.
The BNB or tokens collected through the Referral fee are subtracted from the above BNB or secondary fee and sent to the Referral address.
An additional Liquidity fee is charged when locking tokens that is allocated to the team's Dev address.
Whitelisted users are exempt from the fees when locking LP tokens.
Once the specified unlock time has passed, the lock owner may withdraw the deposited tokens at any time.
Lock owners may extend the lock duration of any of their locks. An additional Liquidity fee is taken when extending the lock duration.
Lock owners may add additional LP tokens to any of the locks that they own. An additional Liquidity fee is taken from the original balance before the new LP tokens are added.
Token locks can also be split into two separate locks. There is a fee in BNB associated with this action.
Lock owners may transfer the ownership of any owned locks to any other address.
If a Migrator address has been set, owners may use the Migrator to move their locks to a new contract. The Migrator contract was outside the scope of this audit, so we cannot provide an assessment with regards to security.
The owner can update the Dev and Migrator address at any time.
The owner can set the minimum amount of the secondary token a referral address must hold to any value at any time.
The owner can set the secondary token to any address at any time.
The owner can set the BNB fee, Liquidity fee, Referral fee, Referral discount, Secondary token fee, and Secondary token discount to any values at any time.
The owner can add or remove any address from the fee whitelist at any time.
Presale Contracts:
Any user may use the PresaleGenerator contract to generate a new Presale contract where users will be able to deposit BNB or the specified Base token into the contract in exchange for an amount of the Presale token.
In order for a new contract to be generated, the Presale generator contract must be pre-approved by the owner as a valid generator address in the PresaleFactory contract.
Every generated Presale contract will be registered as a valid contract in the PresaleFactory contract.
The team will set the addresses of the Presale token and the Base token accepted for payment upon deployment of the contract.
Upon deployment, the team will also set the soft cap and hard cap amounts, the price of the Presale token, a referral address, the maximum amount that can be purchased per wallet, the percentage of tokens that will be locked as liquidity, and the start time & end of the sale.
The total Presale time cannot exceed the maximum value set in the PresaleSettings contract.
The provided liquidity percentage must be at least 30% and the lock duration cannot be less than 4 weeks.
The amount of BNB entered when creating a Presale contract must be equivalent to the Creation fee in the PresaleSettings contract.
The BNB collected through the Creation fee is sent to the team's Fee address.
The provided referral address must have been whitelisted by the team in the PresaleSettings contract.
Users can deposit an amount of BNB (or the base token) into the contract and will be allocated a number of the Presale token based on the amount that the user deposited.
If the current block falls within Round 1 (determined by the owner), the user must hold the minimum number of the early-access token set by the team in the PresaleSettings contract in order to deposit BNB or tokens.
After the Round 1 block has passed, the early-access token restriction is no longer enforced.
A Presale is considered successful when the total number of base tokens in the contract exceeds the hard cap or if the end block has been reached and the soft cap has been met.
After the presale has been considered successful, the Presale owner must then add liquidity.
Upon adding liquidity, a pair will be created with the Presale token and the Base token and liquidity will be locked in the MoonforceLocker contract for the duration set by the Presale owner via the PresaleLockForwarder contract.
A Referral fee and a MoonForce fee are charged on both the Base tokens and Presale tokens before adding liquidity. The collected tokens are sent to the Referral address and the team's Base fee address respectively.
If the remaining Presale tokens in the contract is greater than the total number of Presale tokens sold, the remaining tokens in the contract will be sent to the 0x..dead address.
Any remaining Base tokens or BNB in the contract are sent to the Presale owner.
Users can withdraw the full number of Presale tokens due to them after liquidity has been added by the team.
A presale is considered unsuccessful if the end time has been reached and the soft cap has not been met.
Any user can force fail the presale if the liquidity pair already exists but liquidity had yet to be added by the Presale owner.
The team's Fee address can force fail the presale at any time.
If a presale has failed, the user can withdraw their deposited BNB or Base tokens at any time, and the Presale owner can withdraw all of the presale tokens at any time.

The Presale owner can update the maximum spend amount to any value at any time.
The Presale owner can update the start time and end time if the presale has not yet started. The total duration cannot exceed the maximum Presale length in the PresaleSettings contract.
The Presale owner can enable/disable the enforcing of the presale whitelist at any time.
The Presale owner can add/removes accounts from the presale whitelist at any time.

The owner can update the team's Fee wallets at any time.
The owner can update the Base fee, Presale token fee, Referral fee, and Creation fee to any values at any time.
The owner can set the length of Round 1 to any value at any time.
The owner can set the maximum Presale length to any value at any time.
The owner can add/remove accounts from the referral list at any time.
The owner can add/remove early-access token addresses at any time.