Arbitrum Farms

Panther fork

• ⚠️ As of time of review, Presale is still active. Liquidity is not yet supplied and will be added only after their presale ends. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.
• ⚠️ Masterchef uses per-block emissions instead of per-time. This is an antipattern on networks that uses variable block timing.
• ✅ Max 4% deposit fees.
• ✅ Token owner is MasterChef.
• ✅ Masterchef behind a 6 hr timelock.
• ✅ Correctly accounts for transfer taxes on any token pool.
• 2% referral (max 3%)
• An extra 5% of emission rewards are minted to the dev address.
• 0.5 transfer tax (max 1%)
• 20% anti-whale (min 1%)

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xd619...73cc)

Rugged. Website down. Dev drained the Genesis contract throught a custom code

Rugger bridged the funds to Ethereum and finally withdrawn to Kucoin [tx1 | tx2 | tx3]

• ⚠️ Liquidity is unlocked and can be removed and dumped at any time [tx]. Please clarify with the project on liquidity locking or burning
• ⚠️ Withdrawals and harvests will fail if escrow wallet (multisig) revokes approval to staking contract. Users will still be able to emergency withdraw though.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ No deposit fees
• Escrow wallet can be set to the zero address, which would block regular withdrawals and harvests.
• Token owner is a contract called Authority (0xcc65...2f80 - same as Masterchef owner) that is governed through a multisig wallet (0xa178...6cfe - the same one indicated as escrow wallet in Masterchef). ⚠️ Tokens corresponding to the distribution stage are minted directly to the multisig wallet. This wallet can indicate the end of the distribution stage, but it also has ways to bypass this limitation and continue minting at will.
• 4 of the 5 Owners of the multisig wallet were funded from the same wallet on the Polygon network:
  • 0x9B6...FC21 was funded by 0xb6...e36f who in turn was funded by 0x98...bb22.
  • 0xd7...d58B was funded by 0xa2...7902 who in turn was funded by 0x9e39...11d2.
  • 0x9E39...11d2 was funded by 0x98...bb22.
  • 0xa8d...7124 was funded by 0x9e...11d2 who in turn was funded by 0x98...bb22.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1288D0...23be).

Radiant Capital is a new, huge lending protocol on Arbitrum. They seem to be an official partner of Arbitrum.

As this protocol looks like a Geist fork, we refer to the following:

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Stargate Finance is, in his own words, a community-driven organization building the first fully composable native asset bridge, and the first dApp built on LayerZero. Stargate's vision is to make cross-chain liquidity transfer a seamless, single transaction process.

The underlying assets are first deposited in pools that are responsible for providing liquidity between bridge destinations. In addition to getting returns for the transfer fees, the user can deposit these receipts in the farms and earn additional rewards in $STG (governance token). This last mechanism is carried out using a masterchef for each network. Bellow we detail some points that we were able to observe to those that are implemented at the time of this review:

• Masterchef is not behind Timelock. It is behind a multisig, but the documents do not specify who the signers would be.
• No deposit fees.
• ⚠️ Does not support deflationary/transfer-tax token pools.
• No audit is specified in the doc to date.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Sperax USD appears to be a yield bearing crypto-collateralized algorithmic stablecoin on the Arbitrum network. USDs is a hybrid crypto-collateralized and algorithmic stablecoin.

Having said the above, we reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

SmartCoin fork.

• ⚠️ Unverified Masterchef. This review was done via bytecodes decompilation and Sourcify, as the team claims that they've got issues verifying the contract on Arbiscan.
• ⚠️ Unable to verify if Masterchef is behind Timelock
• ⚠️ Masterchef does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Masterchef can be prone to reentrancy on its emergencyWithdraw function
• ⚠️ Token owner is EOA and can mint/dump tokens at any time.
• ✅ Masterchef uses block timestamps for reward calculation.
• Masterchef may use Rewarder contracts that can issue bonus rewards to users, though if they are malicious then deposits/withdrawals may potentially be blocked, or harvests stolen. Unable to verify if they are used since unverified contract.
• Dev/Investor/Treasury address can be set to the zero address, which would block regular deposits, withdrawals, and harvests
• Regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• 1/10 of emissions minted to dev/treasury/investor

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (Ends in AFeF)

Decentralized futures trading protocol similar to GMX. We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Goose fork

• ✅ Max 3.5 % withdraw fees also on emergencyWithdraw (no deposit fees)
• ✅ Masterchef behind a 6 hr timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• 10% of emission rewards minted to dev address
• 2% of emission rewards minted are burned automatically.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x0460253F...895F)

🚨🚨🚨 Contains HARD RUG code that can steal staked tokens at any time 🚨🚨🚨

🚨 PancakeSwap fork with migrator code that grants infinite approval 🚨

• 🚨 The migrator has already been called, so it doesn't matter if the contract is placed under timelock or a SafeOwner. Infinite approval to withdraw from all pools has already been granted

Fullsail fork

• ⚠️ Masterchef currently not behind a timelock
• ✅ Max 4% withdraw fees
• ✅ All transfer-tax tokens are supported
• 10% of emissions sent to dev address
• 10% of emissions sent to burn address

⚠️ Triple check the contract you interact matches the one reviewed here (0xAd60...27d3)

Goose fork

• ✅ Max 4% deposit fees
• ✅ Masterchef behind a 3 hour timelock
• 10% of emissions sent to dev address
• ⚠️ Does not support pools with deflationary / transfer-tax tokens. Just confirm with the team that these will not be added

⚠️ Triple check the contract you interact matches the one reviewed here (0x1a83...0b3c)

SushiSwap fork with migrator removed. Uses its own AMM.

• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Rewarder contract can be updated on pools to block withdrawals
• ✅ No deposit fees
• AMM/Router is a perfect clone of SushiSwap's V2

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xa0e82975...8Dc5)

Goose fork

• 🚨 Hard rug code not found, but the project is High Risk for advance claims that it has undergone RugDoc review and RugDoc KYC. Kindly note that this is the only time we had the chance to look into this project and we have no previous contact with them for any of our services.
• ✅ Max 10% deposit fees
• ✅ Masterchef behind a 3-hour timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• No referral
• 1/10th of emission rewards minted to dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xdf64...dedde)

🚨🚨🚨 Contains HARD RUG code that can steal staked tokens at any time 🚨🚨🚨

🚨 PancakeSwap fork with migrator code intact 🚨

• 🚨 Migrator grants infinite approval to tokens, so can be called even before adding a timelock

ParrotDefi clone (including docs)

• ⚠️ Masterchef currently not behind a timelock
• ✅ Max 4% deposit fees
• ✅ Correctly accounts for transfer taxes on any token pool
• 1/10th of emission rewards minted to dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xF4E66a35...0c70)

PolyPup Collar clone with antiwhale

• ✅ Masterchef under a 48hr timelock
• ✅ Max 4% deposit fees
• ✅ Correctly accounts for transfer taxes on any token pool
• 1/10th of emission rewards minted to dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1cCf20F4...2311)

Goose fork

• ✅ Masterchef behind a 10 hour timelock
• ✅ Max 4% withdrawal fees, also applied to emergency withdrawal
• ✅ All transfer-tax tokens are supported
• 10% of emissions sent to dev address

⚠️ Triple check the contract you interact matches the one reviewed here (0xf433...6382)