Wagyu - Smart Contract Audit Report

Summary

Wagyu Audit Report Wagyu is building a new decentralized exchange with a yield farming platform.

For this audit, we analyzed Wagyu's PancakeSwap core and pefiphery contracts along with their WAGFarm staking contract. We reviewed the team's code at the following commits:

Notes on the Contracts:

PancakeERC20 Contract:
The PancakeERC20 contract implements the ERC20 standard liquidity token.
This contract utilizes a 'permit' mechanism which allows the owner of the $Wagyu-LP tokens to sign a transaction that allows another user to withdraw tokens and send it to the recipient. The recipient, then submits the permit on behalf of the owner.
WagyuFactory Contract:
The WagyuFactory contract is responsible for the creation of liquidity pairs for the token, thereby enabling trading on the platform.
At the time of deployment, the initiliaze() function is called from the PancakePair contract which allows the factory to specify the two ERC20 tokens that this pair will exchange.
Once the pool is created, its address is stored with a double mapping that takes both token addresses as input.
PancakePair Contract:
The PancakePair contract is the core Uniswap functionality that implements the liquidity pool that exchanges tokens.
This contract is responsible for tracking balances of ERC20 tokens, as well as mints and burns of the liquidity token.
PancakeRouter Contract:
The PancakeRouter contract is used to interact with the liquidity pool that was created in the PancakeFactory contract.
PancakeRouter routes orders to the user-determined pair contract to swap assets.
This contract performs requirement checks needed for swapping tokens, adding liquidity, and removing liquidity.
WAGFarm Contract:
Users can stake various tokens in the WAGFarm contract into pools to earn rewards in the form of the project's native WAGToken.
A pool's share of rewards generated can be changed by the owner at any time.
When rewards are generated, an additional 10% of minted WAGTokens are minted to a dev address.
A Migrator function is present, allowing the team to migrate all of user's staked funds to a new contract without restriction.
The WAGFarm staking contract should not be used with deflationary tokens or ERC-777 tokens. If a deflationary token is added as a staking asset, then the contract must be exempt from transfer fees.
The team must also be careful not to add the same token twice for staking.
Two lines perform a multiplication on the result of a division, leading to less accurate results. It is advisable to always do all multiplication prior to division. Applicable lines can be viewed here.
A number of functions could be declared external instead of public to save some gas on each call. Applicable functions can be viewed here.
Utilization of SafeMath (or similarily safe functions) to prevent overflows.

Audit Findings Summary:
No security issues from outside attackers were identified.
Ensure trust in the team as they can migrate users' staked funds.
Date: September 28th, 2021

Combined External Threat Results

Vulnerability Category	Notes	Result
Arbitrary Storage Write	N/A	PASS
Arbitrary Jump	N/A	PASS
Delegate Call to Untrusted Contract	N/A	PASS
Dependence on Predictable Variables	N/A	PASS
Deprecated Opcodes	N/A	PASS
Ether Thief	N/A	PASS
Exceptions	N/A	PASS
External Calls	N/A	PASS
Integer Over/Underflow	N/A	PASS
Multiple Sends	N/A	PASS
Suicide	N/A	PASS
State Change External Calls	N/A	PASS
Unchecked Retval	N/A	PASS
User Supplied Assertion	N/A	PASS
Critical Solidity Compiler	N/A	PASS
Overall Contract Safety		PASS

Details: WagyuFactory

Smart Contract Graph

Contract Inheritance


 ($) = payable function
 # = non-constant function
 				
 + [Int] IPancakeFactory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

 + [Int] IPancakePair 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #
    - [Ext] MINIMUM_LIQUIDITY
    - [Ext] factory
    - [Ext] token0
    - [Ext] token1
    - [Ext] getReserves
    - [Ext] price0CumulativeLast
    - [Ext] price1CumulativeLast
    - [Ext] kLast
    - [Ext] mint #
    - [Ext] burn #
    - [Ext] swap #
    - [Ext] skim #
    - [Ext] sync #
    - [Ext] initialize #

 + [Int] IPancakeERC20 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #

 + [Lib] SafeMath 
    - [Int] add
    - [Int] sub
    - [Int] mul

 +  PancakeERC20 (IPancakeERC20)
    - [Pub]  #
    - [Int] _mint #
    - [Int] _burn #
    - [Prv] _approve #
    - [Prv] _transfer #
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] permit #

 + [Lib] Math 
    - [Int] min
    - [Int] sqrt

 + [Lib] UQ112x112 
    - [Int] encode
    - [Int] uqdiv

 + [Int] IERC20 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #

 + [Int] IPancakeCallee 
    - [Ext] pancakeCall #

 +  PancakePair (IPancakePair, PancakeERC20)
    - [Pub] getReserves
    - [Prv] _safeTransfer #
    - [Pub]  #
    - [Ext] initialize #
    - [Prv] _update #
    - [Prv] _mintFee #
    - [Ext] mint #
       - modifiers: lock
    - [Ext] burn #
       - modifiers: lock
    - [Ext] swap #
       - modifiers: lock
    - [Ext] skim #
       - modifiers: lock
    - [Ext] sync #
       - modifiers: lock

 +  WagyuFactory (IPancakeFactory)
    - [Pub]  #
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

Details: Pefiphery

Smart Contract Graph

Contract Inheritance


 ($) = payable function
 # = non-constant function
 				
 + [Int] IUniswapV2Callee 
    - [Ext] uniswapV2Call #

 + [Int] IUniswapV2Pair 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #
    - [Ext] MINIMUM_LIQUIDITY
    - [Ext] factory
    - [Ext] token0
    - [Ext] token1
    - [Ext] getReserves
    - [Ext] price0CumulativeLast
    - [Ext] price1CumulativeLast
    - [Ext] kLast
    - [Ext] mint #
    - [Ext] burn #
    - [Ext] swap #
    - [Ext] skim #
    - [Ext] sync #
    - [Ext] initialize #

 + [Lib] SafeMath 
    - [Int] add
    - [Int] sub
    - [Int] mul

 + [Lib] PancakeLibrary 
    - [Int] sortTokens
    - [Int] pairFor
    - [Int] getReserves
    - [Int] quote
    - [Int] getAmountOut
    - [Int] getAmountIn
    - [Int] getAmountsOut
    - [Int] getAmountsIn

 + [Int] IUniswapV1Factory 
    - [Ext] getExchange

 + [Int] IUniswapV1Exchange 
    - [Ext] balanceOf
    - [Ext] transferFrom #
    - [Ext] removeLiquidity #
    - [Ext] tokenToEthSwapInput #
    - [Ext] ethToTokenSwapInput ($)

 + [Int] IPancakeRouter01 
    - [Ext] factory
    - [Ext] WETH
    - [Ext] addLiquidity #
    - [Ext] addLiquidityETH ($)
    - [Ext] removeLiquidity #
    - [Ext] removeLiquidityETH #
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)
    - [Ext] quote
    - [Ext] getAmountOut
    - [Ext] getAmountIn
    - [Ext] getAmountsOut
    - [Ext] getAmountsIn

 + [Int] IERC20 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #

 + [Int] IWETH 
    - [Ext] deposit ($)
    - [Ext] transfer #
    - [Ext] withdraw #

 +  ExampleFlashSwap (IUniswapV2Callee)
    - [Pub]  #
    - [Ext]  ($)
    - [Ext] uniswapV2Call #

 + [Int] IUniswapV2Factory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

 + [Lib] FixedPoint 
    - [Int] encode
    - [Int] encode144
    - [Int] div
    - [Int] mul
    - [Int] fraction
    - [Int] decode
    - [Int] decode144

 + [Lib] PancakeOracleLibrary 
    - [Int] currentBlockTimestamp
    - [Int] currentCumulativePrices

 +  ExampleOracleSimple 
    - [Pub]  #
    - [Ext] update #
    - [Ext] consult

 +  ExampleSlidingWindowOracle 
    - [Pub]  #
    - [Pub] observationIndexOf
    - [Prv] getFirstObservationInWindow
    - [Ext] update #
    - [Prv] computeAmountOut
    - [Ext] consult

 + [Lib] Babylonian 
    - [Int] sqrt

 + [Lib] TransferHelper 
    - [Int] safeApprove #
    - [Int] safeTransfer #
    - [Int] safeTransferFrom #
    - [Int] safeTransferETH #

 +  ExampleSwapToPrice 
    - [Pub]  #
    - [Pub] computeProfitMaximizingTrade
    - [Pub] swapToPrice #

 + [Int] IPancakeRouter02 (IPancakeRouter01)
    - [Ext] removeLiquidityETHSupportingFeeOnTransferTokens #
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #

 + [Int] IPancakeMigrator 
    - [Ext] migrate #

 +  PancakeMigrator (IPancakeMigrator)
    - [Pub]  #
    - [Ext]  ($)
    - [Ext] migrate #

 +  PancakeRouter (IPancakeRouter02)
    - [Pub]  #
    - [Ext]  ($)
    - [Int] _addLiquidity #
    - [Ext] addLiquidity #
       - modifiers: ensure
    - [Ext] addLiquidityETH ($)
       - modifiers: ensure
    - [Pub] removeLiquidity #
       - modifiers: ensure
    - [Pub] removeLiquidityETH #
       - modifiers: ensure
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Pub] removeLiquidityETHSupportingFeeOnTransferTokens #
       - modifiers: ensure
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Int] _swap #
    - [Ext] swapExactTokensForTokens #
       - modifiers: ensure
    - [Ext] swapTokensForExactTokens #
       - modifiers: ensure
    - [Ext] swapExactETHForTokens ($)
       - modifiers: ensure
    - [Ext] swapTokensForExactETH #
       - modifiers: ensure
    - [Ext] swapExactTokensForETH #
       - modifiers: ensure
    - [Ext] swapETHForExactTokens ($)
       - modifiers: ensure
    - [Int] _swapSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
       - modifiers: ensure
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
       - modifiers: ensure
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #
       - modifiers: ensure
    - [Pub] quote
    - [Pub] getAmountOut
    - [Pub] getAmountIn
    - [Pub] getAmountsOut
    - [Pub] getAmountsIn

 +  PancakeRouter01 (IPancakeRouter01)
    - [Pub]  #
    - [Ext]  ($)
    - [Prv] _addLiquidity #
    - [Ext] addLiquidity #
       - modifiers: ensure
    - [Ext] addLiquidityETH ($)
       - modifiers: ensure
    - [Pub] removeLiquidity #
       - modifiers: ensure
    - [Pub] removeLiquidityETH #
       - modifiers: ensure
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Prv] _swap #
    - [Ext] swapExactTokensForTokens #
       - modifiers: ensure
    - [Ext] swapTokensForExactTokens #
       - modifiers: ensure
    - [Ext] swapExactETHForTokens ($)
       - modifiers: ensure
    - [Ext] swapTokensForExactETH #
       - modifiers: ensure
    - [Ext] swapExactTokensForETH #
       - modifiers: ensure
    - [Ext] swapETHForExactTokens ($)
       - modifiers: ensure
    - [Pub] quote
    - [Pub] getAmountOut
    - [Pub] getAmountIn
    - [Pub] getAmountsOut
    - [Pub] getAmountsIn

 +  DeflatingERC20 
    - [Pub]  #
    - [Int] _mint #
    - [Int] _burn #
    - [Prv] _approve #
    - [Prv] _transfer #
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] permit #

 +  ERC20 
    - [Pub]  #
    - [Int] _mint #
    - [Int] _burn #
    - [Prv] _approve #
    - [Prv] _transfer #
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] permit #

 +  RouterEventEmitter 
    - [Ext]  ($)
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)

 +  Migrations 
    - [Pub]  #
    - [Pub] setCompleted #
       - modifiers: restricted

 +  WETH9 
    - [Pub] deposit ($)
    - [Pub] withdraw #
    - [Pub] totalSupply
    - [Pub] approve #
    - [Pub] transfer #
    - [Pub] transferFrom #

Details: WAGFarm

Smart Contract Graph

Contract Inheritance


 ($) = payable function
 # = non-constant function
 
  + [Lib] SafeMath 
    - [Int] add
    - [Int] sub
    - [Int] sub
    - [Int] mul
    - [Int] div
    - [Int] div
    - [Int] mod
    - [Int] mod
    - [Int] min
    - [Int] sqrt

 + [Int] IBEP20 
    - [Ext] totalSupply
    - [Ext] decimals
    - [Ext] symbol
    - [Ext] name
    - [Ext] getOwner
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Lib] Address 
    - [Int] isContract
    - [Int] sendValue #
    - [Int] functionCall #
    - [Int] functionCall #
    - [Int] functionCallWithValue #
    - [Int] functionCallWithValue #
    - [Prv] _functionCallWithValue #

 + [Lib] SafeBEP20 
    - [Int] safeTransfer #
    - [Int] safeTransferFrom #
    - [Int] safeApprove #
    - [Int] safeIncreaseAllowance #
    - [Int] safeDecreaseAllowance #
    - [Prv] _callOptionalReturn #

 +  Context 
    - [Pub]  #
    - [Int] _msgSender
    - [Int] _msgData

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Int] _transferOwnership #

 +  BEP20 (Context, IBEP20, Ownable)
    - [Pub]  #
    - [Ext] getOwner
    - [Pub] name
    - [Pub] decimals
    - [Pub] symbol
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Pub] mint #
       - modifiers: onlyOwner
    - [Int] _transfer #
    - [Int] _mint #
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _burnFrom #

 +  WAGToken (BEP20)
    - [Pub] mint #
       - modifiers: onlyOwner
    - [Ext] delegates
    - [Ext] delegate #
    - [Ext] delegateBySig #
    - [Ext] getCurrentVotes
    - [Ext] getPriorVotes
    - [Int] _delegate #
    - [Int] _moveDelegates #
    - [Int] _writeCheckpoint #
    - [Int] safe32
    - [Int] getChainId

 +  WAGStake (BEP20)
    - [Pub] mint #
       - modifiers: onlyOwner
    - [Pub] burn #
       - modifiers: onlyOwner
    - [Pub]  #
    - [Pub] safeCakeTransfer #
       - modifiers: onlyOwner
    - [Ext] delegates
    - [Ext] delegate #
    - [Ext] delegateBySig #
    - [Ext] getCurrentVotes
    - [Ext] getPriorVotes
    - [Int] _delegate #
    - [Int] _moveDelegates #
    - [Int] _writeCheckpoint #
    - [Int] safe32
    - [Int] getChainId

 + [Int] IMigratorChef 
    - [Ext] migrate #

 +  WAGFarm (Ownable)
    - [Pub]  #
    - [Pub] updateMultiplier #
       - modifiers: onlyOwner
    - [Ext] poolLength
    - [Pub] add #
       - modifiers: onlyOwner
    - [Pub] set #
       - modifiers: onlyOwner
    - [Int] updateStakingPool #
    - [Pub] setMigrator #
       - modifiers: onlyOwner
    - [Pub] migrate #
    - [Pub] getMultiplier
    - [Ext] pendingCake
    - [Pub] massUpdatePools #
    - [Pub] updatePool #
    - [Pub] deposit #
    - [Pub] withdraw #
    - [Pub] enterStaking #
    - [Pub] leaveStaking #
    - [Pub] emergencyWithdraw #
    - [Int] safeCakeTransfer #
    - [Pub] dev #

Go Home

SourceHat

Wagyu - Smart Contract Audit Report

Summary

Combined External Threat Results

Details: WagyuFactory

Function Graph

Inheritence Chart

Functions Overview

Details: Pefiphery

Function Graph

Inheritence Chart

Functions Overview

Details: WAGFarm

Function Graph

Inheritence Chart

Functions Overview