Yoloverse is a new DeFi protocol on the Binance Smart Chain which introduces NFTs which earn yield in the project's native token, provide discounts on protocol fees, and have rarity rankings which can be leveled-up by users.
For this audit, we reviewed the project's Artifact, Keeper, Loyalty, Yolonaut, and YoloV contracts. The code was reviewed at commit df38450736bda7457e9cafa570e6d1efc8f3e780 on the project team's private GitHub repo.
Notes on the YoloV Token Contract:
The initial total supply of the token is 97 million.
The token can be minted by the Yolonaut contract (also referred to as the DivSpotNftContract). The token can also be minted by the FomoRouter, and by the 'Portal' contract until migraiton is set to completed, which were not reviewed as a part of this audit.
There is a transfer tax applied on the token, part of which is used held in the contract and used to fund NFT rewards discussed below.
Other fees applies on transfers are used for burns and funding liquidity.
Upon transfers of the token, user's Loyalty NFT attributes will be updated. If a buy is made above a set price, Loyalty NFTs will automatically be minted.
The owner of the contract had the ability to call mintFromSnapshot to mint tokens directly to addresses. This function is no longer accessible since migration has been set to completed by the team.
The team can set the cooldowns at any time to a value between 12 hours and 3 days for dividends and 30 minutes to 4 hours for loyalty claims.
The team can also update sell tax to any value between 3% and 10%, can update the gas refund amount, the LP address, and the address of other contracts used in the ecosystem.
The createInitialDivAccounts() function uses a loop to mint NFTs to an array of users. As the owner inputs the users to receive the NFT, this is not an issue, but the team must be aware that due to the cost of the operation and the block gas limit, minting NFTs to a large number of users will need to be split among multiple calls to the function.
The contract uses an 'antiReentrant' modifier to prevent reentrancy, and compiler version 0.8.x, providing protection from overflows.
Notes on the Loyalty NFT Contract:
There is a maximum total supply of 3000, composed of NFTs of various rank.
Loyalty NFTs can have the following rarity ranks, with less NFTs of each ascending rank: RECRUIT, ADJUTANT, PRIESTESS, SPECTRE, ANDROID, MATRIX, SINGULARITY, and NIRVANA.
The YoloV contract has the ability to mint the Loyalty NFTs.
The price of minting NFTs (denominated in BNB) will increase as more NFTs are minted.
NFT Holders can 'evolve' their NFTs by contributing YoloV tokens to the Keeper contract.
The getTokensRequiredForEvolve() function relies upon a live price for determining the price in YoloV tokens to evolve a user's NFT. The price used in this function could be manipulated by a flash loan; though the transaction taxes incurred weighed against the value of a cheaper NFT evolution would not be profitable.
Users who win a contest can claim a nirvana level NFT using the royalEvolve() function. The user must be recruit level at the time of winning. If the user does not claim within 3 days, the team can conduct a new contest.
Users who hold Loyalty NFTs will be able to claim YoloV tokens collected through protocol fees.
Users receive discounts on the fee imposed on rewards based upon the ranking of their respective NFT.
The team can update all of the external contract addresses used by the contract.
The team can also adjust the claim fee by 20% and allocate how the fee is distributed.
The following functions could be declared external instead of public to save gas on each call: getTokensRequiredForEvolve(), canMint(), canEvolve(), canEvolveToDiv(), canClaim(), and totalSupply().
The contract uses an 'antiReentrant' modifier to prevent reentrancy, and compiler version 0.8.x, providing protection from overflows.
Notes on the Keeper Contract:
This contract holds the funds users contribute to their loyalty NFTs.
When users withdraw, they will receive the tokens deposited towards their NFT, but their loyalty NFT will be given up and locked in the contract.
Based on the rarity of the Artifact NFT held, if applicable, users can reap 20%-95% discount on the 10% withdrawal fee charged by the protocol. Note this will lock their Artifact NFT in the contract as well.
The team can update the address of the loyalty, keeper, auto-compound and artifacts contracts, and can claim NFTs held in the contract at any time.
The contract uses an 'antiReentrant' modifier to prevent reentrancy, and compiler version 0.8.x, providing protection from overflows.
Notes on the Artifact NFT Contract:
There is a maximum supply of 445 NFTs of various rank.
Artifact NFTs can have the following rarity ranks: AMETHYST, OPAL, DIAMOND, and WARP_STONE.
The NFTs can be minted by the Loyalty NFT contract, or individually by the owner of the contract up to the maximum supply of each rarity rank.
The Loyalty NFT contract will automatically mint an Artifact NFT every time a set number of Loyalty NFTs is minted.
Users who hold an Artifact NFT can optionally ecounter reduced fees protocol fees when withdrawing from the Keeper contract. The reduction in fees is greater with rarer Artifact NFTs.
The team can update the address of the loyalty, keeper, and marketplace contracts at any time.
The contract uses compiler version 0.8.x, providing protection from overflows.
Notes on the Yolonaut NFT Contract:
There is a maximum supply of 500 Yolonaut NFTs of various rank.
Artifact NFTs can have the following rarity ranks: COMMON, RARE, EPIC, and LEGENDARY.
The NFTs can be minted by the YoloV Token contract, the evolution of their rarity is based upon the passing of a number of blocks. Thresholds exist at 10, 30, and 60 days.
The price (in BNB) at which the Yolonaut NFTs are minted are based upon the amount of YoloV tokens held in the token contract as rewards. The minimum price is 10BNB.
Yolonaut NFTs require a Loyalty NFT at the rank of recruit to be held by the user.
The NFTs give their bearer the right to rewards collected from protocol fees.
Rewards are denominated in the project's native YoloV token and are distributed to holders 24 hours to the holder's locked balance.
When the NFT holders wants to claim their yield, they will have to surrender (burn) their NF to do so.
Yolonaut NFTs will also entitle the holder to go through an easier evolution path for Loyalty NFTs.
The team can update the addresses of external contracts used by the contract.
The team can also update the claim fee between 10 and 30%, and how the fees collected are distributed.
The owner can update the distribution speed and cooldown as well.
The canMint() function could be declared external instead of public to save gas on each call.
The contract uses an 'antiReentrant' modifier to prevent reentrancy, and compiler version 0.8.x, providing protection from overflows.
Audit Findings Summary:
No substantial security issues from external attackers were identified.
Ensure trust in the team as they have substantial control in the ecosystem.
Date: August 3rd, 2021
External Threats - Audit Results
Vulnerability Category
Notes
Result
Arbitrary Storage Write
N/A
PASS
Arbitrary Jump
N/A
PASS
Delegate Call to Untrusted Contract
N/A
PASS
Dependence on Predictable Variables
N/A
PASS
Deprecated Opcodes
N/A
PASS
Ether Thief
N/A
PASS
Exceptions
N/A
PASS
External Calls
N/A
PASS
Flash Loans
getTokensRequiredForEvolve() uses live pricing when evolving a user's NFT. Both probability and impact of exploitation is very low.
