Arbitrum Farms

Fork of OlympusDAO:

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.
• ⚠️ ⚠️ Token minter is the Treasury contract but as the Token owner is the deployer this can be changed at any time so that the Owner can mint & dump.
• Project is carry on two presale at the same time, one as public sale and another as private sale both for whitelisted users. ⚠️ Both contracts allow the Deployer withdraw the USDC at any time without restriction. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.

Having said the above, we are classifying this as [Not Eligible] as we recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks.

Custom transfer-tax / reflection BEP20 token implementation

• ⚠️ As of time of review, Liquidity is not yet supplied and will be added only after their presale ends. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.
• ⚠️ It claims to have an audit but it does not appear on the project website.
• ✅ Token Router Hardcoded
• Deployer's wallet funded by the Lychee Token deployer (see tx), which leads us to think that it may be the same person behind both projects.
• Autoliquidity LP Tokens are burned
• Max Supply: 100M
• PreMinted: 100%
  • 66% for presale
  • 27% will be used later to add liquidity.
• Payout Method: Reflection
• Auto-Liquidity: 3%
• Other Significant Governance Privileges: None
• 7% transfer tax (fixed)
• Anti-whale disabled

⚠️ Triple check the contract you interact matches the one reviewed here (0xe4c029...2c2f)

Goose fork

• ⚠️ Liquidity is just staked in the masterchef and can be removed and dumped at any time. Please clarify with the project on liquidity locking or burning
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable.
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.3% swap fee - There is a mismatch in the fees calculated by the router and those calculated by the pairs). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0xdbc473...7d91).
• ✅ No deposit fees
• ⚠️ Masterchef behind a 1 hr timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• An extra 10% of emission rewards are minted to the dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1f5fd1...1cC4)

Panther fork without referrals

• ⚠️ The liquidity has simply been sent to the Timelock contract. This can be withdrawn at any time. Please clarify with the project on liquidity locking or burning (txs).
• ✅ Max 10% deposit fees
• ✅ Masterchef behind a 24 hr timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• An 13.5% of emission rewards are minted to the dev and marketing address. ⚠️ Both rates can be increased by up to 200% each due to a bug in the code. This can cause deposits, withdrawals and harvests to fail.
• ⚠️ Masterchef contract may indicate rewarder contracts for additional rewards for each pool, but it is currently not in use. Please note that any errors in its implementation can block deposits, harvests and withdrawals (even emergency withdrawals).
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.25% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x16e71B...32Ad).
• Native Token uses role-based access control.
  • ✅ Only the Masterchef has Minter role.
  • ⚠️ Token transfers can be paused at any time by a user with pauser role, which in this case is the dev wallet.
  • ⚠️ Admin role is held by the Timelock contract. So there is a risk that it assigns the Minter role to any user wallet.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• No transfer tax
• No anti-whale
• Harvest lockups disabled (max 14 days)

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x9BA666...BDDD)

Camelot is a complex multi-product project in Arbitrum that utilizes a master contract, CamelotMaster, which delegates user funds to different pools to earn both GRAIL and xGRAIL reward tokens. Currently, there are over 21 pools deployed under the master contract. Paladin audit seems to have covered most of the potential hard-rug risks or funds being stuck.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Custom Transfer-tax / Reflection Token

• ⚠️ Anti-whale can be set artificially low, which could impede/block transfers.
• ⚠️ Reflection Token has includeInReward function which can cause a previously excluded address gain reflection rewards
• ⚠️ Transfer Tax uncapped and can be set to 100%
• ✅ 51% of Total Supply added to liquidity and 81% of LP tokens locked with PandaSale. (⚠️ Before investing, we recommend users to do their own due diligence on the token locker's reliability).
• ✅ Token router address hardcoded.
• ✅ LP pair address hardcoded.
• ✅ Ownership has been renounced.
• LP Tokens are sent to the zero address.
• Max Supply: 100,000 tokens
• PreMinted: 100%
• Payout Method: Reflection
• Auto-Liquidity: 5%
• 5% transfer tax
• 0.5% anti-whale (no minimum)

⚠️ Triple check the contract you interact matches the one reviewed here (0x8e00...8bd0)

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• 🚨 Token Ownership renounced and Token Operator = Treasury. But The developer can recover ownership of the token through the Treasury and with this its operatorship (see code). Owner/Operator can mint & dump.
• 🚨 Token contract can be paused which would block all transfers.
• ⚠️ The website is not yet available. Double check that the contract you are interacting with is the one reviewed here.
• Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ⚠️ Current liquidity is extremely small yet, therefore the genesis rewards cannot be sold
• ⚠️ Governance can drain the contract 90 days after poolEndTime (Operator has been renounced, but the dev can get his/her operator status back)
• ⚠️ Deposit Fee is uncapped
• ✅ No Transfer Tax on Native Token
• ⚠️ Fee address can be set to the zero address, which would block harvests
• Genesis is running for 2 days

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0x563719...9737)

Panther fork without referrals

• ⚠️ Token owner is NOT Masterchef. There is a risk of the dev minting and dumping. Please clarify with the project on token ownership.
• ⚠️ As of time of review, Liquidity is not yet supplied and will be added only after their presale ends. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.
• ⚠️ No pools have been added to the Masterchef. There is a risk of the contract being switched out.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• ✅ Max 2% deposit fees
• ⚠️ Masterchef currently not behind a timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• An extra 10% of emission rewards are minted to the dev address
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.5% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x842067...6F07).
• Harvest lockups up to 5 days

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x8F4Ed4...b66e)

• ⚠️ Liquidity is just staked in the masterchef and can be removed and dumped at any time. Please clarify with the project on liquidity locking or burning
• ⚠️ 100% deposit fees possible.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added.
• ⚠️ Project uses its own router which seems to be a fork of PCS router (0.25% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x951111...99A7).
• ✅ Masterchef behind a 6 hr timelock (0xd8aa28...86f2)
• An extra 0.5% of emission rewards are minted to the referral contract address (0x13319b...2a6a)
• 5% transfer tax (max 10%)
• 0.5% referrals.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xab4d93...cc8d)

• Tokens locked:
  • 10,000 will be unlocked on Jan 19, 2023 (tx)
  • 10,000 will be unlocked on Feb 19, 2023 (tx)
  • 10,000 will be unlocked on Mar 19, 2023 (tx)
• ✅ Masterchef behind a 6 hr timelock (0x38cfa7...fd8c)
• ⚠️ 100% deposit fees possible. Due to the time lock, they should first pass through it in order to modify that parameter.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added. Due to the time lock, they should first pass through it in order to modify that parameter.
• Due to NFT-Staking you can earn an additional reward boost
• An extra 0.5% of emission rewards are minted to the referral contract address (0xefeeb7...4af3)
• 5% transfer tax (max 10%)
• 0.5% referrals.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xfcb6e2...57d3)

Goose fork

• 🚨 Hard rug code not found, but the project is High Risk for the following reason:
  • 🚨 A misconfigured (or malicious) reward contract can block deposits, regular withdrawals, and even emergency withdrawals. None have been implemented at the time of this review.
• ⚠️ The token contract uses role-based access. Dev has renounced his admin and minter roles [tx1 | tx2]. Dev has also transferred ownership to a 24hs timelock [tx]. ⚠️ This, in turn, gives the admin role to the Timelock contract. ⚠️⚠️ Dev can recover the admin role through the timelock and grant himself the minter role again and dev can mint and dump.
• ⚠️ The dev still maintains his Pauser role which gives him the possibility to pause the Token contract. This would block both sales, regular transfers, harvests and regular withdrawals.
• ⚠️ 460K tokens have been pre-minted:
  • 20K have been pre-minted to the developer. Half has been used to add liquidity (tx). The rest is still in possession of it.
  • 90K have been pre-minted to a vesting contract that will start releasing in 23 days (tx).
  • 350K have been pre-minted to another vesting contract that will start releasing in 6 months (tx). ⚠️ These, unlike the previous one, will be fully released at the time of release.
• ⚠️ The owner can freely modify the percentage that is assigned to him from the generated rewards. It can be up to 100%, so the user would not receive anything when claiming them.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Project appears to be using its own router which seems to be a fork of PCS router (swap fee 0.3% - the swap fee can be modified individually for each pair, but in the router it is fixed at 0.3%, which can cause an inconsistency between both contracts in the event of a modification). Ensure that you perform a small test transaction first and check that the Router contract matches the one (0xb35485...178e)
• ✅ Max 10% deposit fees.
• ✅ Correctly accounts for transfer taxes on any token pool.
• No harvest lockups at the time of this review (max 14 days).

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xd5be49...c6c7)

Goose fork

• ✅ Max 2% deposit fees
• ⚠️ Masterchef currently not behind a timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• An extra 10% of emission rewards are minted to the dev address
• 4% transfer tax (max 10%)
• anti-whale disabled (min 5%)

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xe9960f...076D)

Modified PancakeSwap fork with a max supply of 99,999,999 FISH tokens

• 🚨 Front-end is not live as of time of review, smart contracts can be switched out.
• ⚠️ Project appears to be using its own router and factory which seems to be a modified fork of UniswapV2. Ensure that you perform a small test transaction first and check that the Router and Factory contract matches these:
  • Router: [0xcDAe...30d8]
  • Factory: [0x7153...72F3]
• ⚠️ No initial liquidity has been added yet. Please clarify with the project on liquidity locking or burning.
• ⚠️ As of time of review, only one pool have been added to the Masterchef. There is a risk of the contract being switched out.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable.
• ✅ Token owner is MasterChef.
• ✅ No deposit fees.
• ✅ Masterchef behind a 6 hr timelock.
• ✅ Correctly accounts for transfer taxes on any token pool.
• As of time of review, 0.1% of token supply (99,999.99 FISH tokens) are held in a multi-signature wallet. (GnosisSafe)
• An extra 20% of emission rewards are minted to the owner address.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x3314...D029)

Panther fork

• ⚠️ As of time of review, Presale is still active. Liquidity is not yet supplied and will be added only after their presale ends. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.
• ⚠️ Masterchef uses per-block emissions instead of per-time. This is an antipattern on networks that uses variable block timing.
• ✅ Max 4% deposit fees.
• ✅ Token owner is MasterChef.
• ✅ Masterchef behind a 6 hr timelock.
• ✅ Correctly accounts for transfer taxes on any token pool.
• 2% referral (max 3%)
• An extra 5% of emission rewards are minted to the dev address.
• 0.5 transfer tax (max 1%)
• 20% anti-whale (min 1%)

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xd619...73cc)

Rugged. Website down. Dev drained the Genesis contract throught a custom code

Rugger bridged the funds to Ethereum and finally withdrawn to Kucoin [tx1 | tx2 | tx3]

• ⚠️ Liquidity is unlocked and can be removed and dumped at any time [tx]. Please clarify with the project on liquidity locking or burning
• ⚠️ Withdrawals and harvests will fail if escrow wallet (multisig) revokes approval to staking contract. Users will still be able to emergency withdraw though.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ No deposit fees
• Escrow wallet can be set to the zero address, which would block regular withdrawals and harvests.
• Token owner is a contract called Authority (0xcc65...2f80 - same as Masterchef owner) that is governed through a multisig wallet (0xa178...6cfe - the same one indicated as escrow wallet in Masterchef). ⚠️ Tokens corresponding to the distribution stage are minted directly to the multisig wallet. This wallet can indicate the end of the distribution stage, but it also has ways to bypass this limitation and continue minting at will.
• 4 of the 5 Owners of the multisig wallet were funded from the same wallet on the Polygon network:
  • 0x9B6...FC21 was funded by 0xb6...e36f who in turn was funded by 0x98...bb22.
  • 0xd7...d58B was funded by 0xa2...7902 who in turn was funded by 0x9e39...11d2.
  • 0x9E39...11d2 was funded by 0x98...bb22.
  • 0xa8d...7124 was funded by 0x9e...11d2 who in turn was funded by 0x98...bb22.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1288D0...23be).

Radiant Capital is a new, huge lending protocol on Arbitrum. They seem to be an official partner of Arbitrum.

As this protocol looks like a Geist fork, we refer to the following:

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Stargate Finance is, in his own words, a community-driven organization building the first fully composable native asset bridge, and the first dApp built on LayerZero. Stargate's vision is to make cross-chain liquidity transfer a seamless, single transaction process.

The underlying assets are first deposited in pools that are responsible for providing liquidity between bridge destinations. In addition to getting returns for the transfer fees, the user can deposit these receipts in the farms and earn additional rewards in $STG (governance token). This last mechanism is carried out using a masterchef for each network. Bellow we detail some points that we were able to observe to those that are implemented at the time of this review:

• Masterchef is not behind Timelock. It is behind a multisig, but the documents do not specify who the signers would be.
• No deposit fees.
• ⚠️ Does not support deflationary/transfer-tax token pools.
• No audit is specified in the doc to date.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Sperax USD appears to be a yield bearing crypto-collateralized algorithmic stablecoin on the Arbitrum network. USDs is a hybrid crypto-collateralized and algorithmic stablecoin.

Having said the above, we reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.