Avalanche Farms

HoudiniSwap is a project that claims to allow trading between multiple assets and multiple chains, using the Monero blockchain as an intermediary to provide a layer of anonymity. The functionality is similar to FixeFloat or similar services, in the sense that no smart contracts are used, instead the deposit by the user is made to a wallet controlled by the project, which then sends.

• ⚠️ RugDoc HIGHLY recommends thinking through all possible scenarios in these types of projects thoroughly and assessing your risk tolerance. DYOR.
• They have their own Token ($POOF: 0x888c...f57a), which is only found on the ETH chain:
  • ⚠️ Transfer can be blocked anytime by blacklisting
  • Initial liquidity locked until Feb 18, 2023 (see tx)
  • Max Supply: 100,000 tokens
  • PreMinted: 100%
  • Taxes: Buy 6% | Sell 6% | Transfer 2%
  • Other Significant Governance Privileges: owner can take out any token from the contract (unless it is the token itself), enable trading once, change all fee receiving addresses and change the ratio's at which these addresses receive fees.

RelyFund uses a referral-based reward or a penalty system where it depends on incoming/outgoing users and 5% of the deposits and withdrawals go to the dev address.

• 🚨 The dev can withdraw any amount of the contract funds at any time without restriction
• 🚨 The dev can blacklist any user, preventing them from claiming rewards.
• ✅ 1% staking fees (Fixed).
• ✅ 1% reward fees (Fixed).
• 5% referral.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here:

• BSC 0xEf38AD...Eb8d
• ETH 0x92e824...f045
• AVALANCHE 0xdb5A21...C65A

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

The project uses a different contract for each pool. All contracts are similar, so the current review is valid for all.

• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ⚠️ Governance can drain the contract 30 days after poolEndTime
• Deposit Fee: 1%
• ✅ Max 1% Deposit Fee
• ✅ No Transfer Tax on Native Token
• ✅ Token Ownership renounced
• ✅ Token Operator = Treasury
• Genesis is running for 2 days

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here

• Avax pool: 0xffb123...5f4F
• USDC pool: 0x516bF6...cB0C
• USDT pool: 0xdEb566...24B6

Similar methodology to other projects that have rugged. Probably the same guy of Peanut Fi and Halloween Tomb.

The website is not working and the liquidity is too low and it is unlocked. Even the rugger requested the review with the same telegram user account and only the name was changed.

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ⚠️ No liquidity yet, therefore the genesis rewards cannot be sold
• ⚠️ Governance can drain the contract 90 days after poolEndTime
• ⚠️ Fee address can be set to the zero address, which would block harvests
• Deposit Fee: 1%
• ✅ Max 1% Deposit Fee
• ✅ TaxOffice Ownership renounced (TransferTax is set to 0%)
• ✅ Token Ownership renounced
• ✅ Token Operator = Treasury
• Genesis is running for 1 day

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0x4fcA...22Be)

Rugged. Website down. Dev pulled out liquidity [tx1 | tx2] for the sum of ~3 $AVAX (~$49) and transferred them to a Binance account.

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• 🚨 Token Ownership not renounced. Owner can mint & dump.
• 🚨 Token Operator is a wallet which can mint & dump
• ⚠️ The site is not working and no pools have been added. There is a risk of the contract being switched out.
• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ⚠️ No liquidity yet, therefore the genesis rewards cannot be sold
• ⚠️ Governance can drain the contract 90 days after poolEndTime
• ✅ Max 5% Deposit Fee. ⚠️ No pool has been added yet, but when it is added you must put some fee for it. Zero fee pools will not accept deposits but will not fail either.
• ✅ No Transfer Tax on Native Token
• Genesis is running for 1 day

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0x14f308...da79)

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• 🚨 Token Ownership not renounced. Owner can mint & dump.
• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ✅ Function governanceRecoverUnsupported removed
• ✅ No Deposit Fee
• ✅ Transfer Tax is capped at 30%
• ✅ Token Operator = Treasury
• Genesis is running for 3 days
• Share Token Operator is the Treasury and the Treasury is an upgradeable proxy. ProxyAdmin owner is a 365-day TimelockController

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0x36C0...829B)

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• ⚠️ No liquidity yet, therefore the genesis rewards cannot be sold
• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ✅ Token Ownership renounced
• ✅ Token Operator = Treasury
• ✅ Max 1% Deposit Fee
• ✅ No Transfer Tax on Native Token
• ✅ Genesis Operator renounced
• ✅ Function governanceRecoverUnsupported cannot be called because Genesis Operator has been renounced
• Genesis is running for 1 day

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0x7757...B51B)

Jarvis Network deals with overcollateralized stablecoins and synthetic fiat currencies in multiple chains. We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Pancakeswap fork with additional custom functions

• ⚠️ Masterchef owner can mint any amount of $AVEX for free to any address. Owner can mint and dump.
• ⚠️ Masterchef owner can burn the deposit receipts of any user without prior approval. This leads to potential loss of unclaimed rewards as it blocks regular withdrawals (emergency withdrawals would still work). This only affects the Avex pool (native token).
• ⚠️ Masterchef owner can transfer (or recover) the Token ownership through the Masterchef contract [see code].
• ⚠️ Masterchef owner can transfer (or recover) the Syrup ownership through the Masterchef contract [see code].
• ⚠️ Either of the above two points can result in the owner being able to mint and dump on you
• ⚠️ Masterchef uses per-block emissions instead of per-time. This is an antipattern on the Avalanche network.
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Project appears to be using its own router which seems to be a fork of PCS router (swap fee 0.2%). Ensure that you perform a small test transaction first and check that the Router contract matches the one (0xe3Cb1b...d9Cd)
• ✅ No deposit fees
• 10M of $AVEX has been preminted
  • 1.9M has been lock with PinkLock (tx1 | tx2 | tx3)
  • 4.5M has been used to presale (tx).
  • ⚠️ 250K has been sent to a fresh wallet (tx).
  • ⚠️ 3.35M still left in the dev wallet (txs)
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• An extra 10% of emission rewards are minted to the dev address.
• Masterchef owner can modify the multiplier to any value, which can lead to an error in the emission.
• Emergency withdraw function is prone to reentrancy attacks in case of vulnerable tokens.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xbf52db...47fa)

Wealth Mountain uses a referral-based reward or a penalty system where it depends on incoming/outgoing users and 10% of the deposits/rewards go to the dev address.

• ⚠️ RugDoc HIGHLY recommends thinking through all possible scenarios in these types of projects thoroughly and assessing your risk tolerance. DYOR.
• ⚠️ Max of 10% early withdrawal fee, min of 2%.
• ✅ Max 10% staking fees.
• 3% referral.
• ⚠️ Withdrawals and harvests will fail once the BUSD/USDC supply has been depleted.
• ⚠️ Pending rewards will continue accumulating once BUSD/USDC supply is depleted, but none could be harvested

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here:

• Ethereum: 0x7d7b7...f0ba
• BSC: 0x9b9c91...701b
• Avalanche: 0x142b12...9d11
• Polygon: 0x142b12...9d11
• Fantom: 0x142b12...9d11

It's a staking contract that uses a referral-based reward system where it depends on incoming users and fees to generate the rewards.

⚠️ RugDoc HIGHLY recommends thinking through all possible scenarios in these types of projects thoroughly and assessing your risk tolerance. DYOR.

• ⚠️⚠️ 50K USDTM tokens have been pre-minted and remain in the dev wallet. These can be dumped at any time.⚠️⚠️
• ⚠️ There is no unstake option so once you stake there is no withdrawing your initial deposit.
• 5% fees
• 2% referrals
• 1.5% daily returns.
• Developer is automatically added as a referral and earns referral rewards in case you didn't indicate any when depositing.

Dev wallet was funded through a bridge by this wallet (0xae6a0b...3b3f | Polygon tx | Avax tx). This in turn, was funded through a bridge by this other wallet (0x31ce4a...9498 | Avax tx | Polygon tx). The latter (0x31ce4...) is the same one that is found as a treasury fund wallet in the $PAE token, the share token of Ripae Finance ($PAE contract).

PLEASE NOTE that the success in these types of projects rely on enough users entering a stake after yours or you will lose money as there will not be enough funds for everyone eligible for a payout to cash out.

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• 🚨 Token Ownership not renounced. Owner can mint & dump
• 🚨 Token Operator is a wallet which can mint & dump
• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• ⚠️ No liquidity yet, therefore the genesis rewards cannot be sold
• ✅ Function governanceRecoverUnsupported removed
• ✅ No Deposit Fee
• ✅ Transfer Tax is capped at 30%
• Genesis is running for 2 days
• Share Token Operator is the Treasury and the Treasury is an upgradeable proxy. ProxyAdmin owner is a 365-day TimelockController

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0xF6aC...673e)

SmartGamble is a new betting protocol, with roulette being its first game released to the public. In addition to betting, the user can choose to be a provider and earn fees generated during failed bets from other players. The protocol is currently implemented in both BSC and Avalanche. Although in their documentation they present themselves as a decentralized protocol, the contracts are still in the possession of the deployer, assuming that it is in its early stage it can be taken as normal, but it is good to know that the parameters of the contracts can be modified without any announcement. The following can also be noted for this project:

• 🚨 Owner can drain any token from House contract (0xee03e1...6b1d) 🚨
• Max win fee: 1% (betting with native token) | 4%.
• Max gamble fee: 1%
• Max withdraw fee: 4%
• Referrer: Max 25%.
• ⚠️ Random contract is unverified (0x320824...8524).

SmartGamble Token ($GAMBLE, live since 5/9/2022)

• Basic ERC20 token
• Total Supply 10,000 $GAMBLE
• 100% premined
• No taxes
• No max tx
• No anti whale
• 🚨 98% of Total Supply added to liquidity but all LP tokens held in EOA with zero locking/vesting. These tokens can be dumped on the market at any time!

We reserve the right to not review complex projects that would require a great deal of senior security analyst man hours. Typically these are projects which requires tons of peer reviews and audits from top audit companies. Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level. DYOR.

Vacus Finance is a yield aggregator protocol running on Avalanche.

The project has an audit by Solidity Finance. ⚠️ Note that it covers only the native token [link].

Some points to consider:

• Max supply: 300M
  • ⚠️ 195M $VCS preminted to an EOA [txs].
  • 75M $VCS pre-minted to 3 different contracts (teamLock, communityLock and marketingLock) of which none are verified.
  • 30M $VCS pre-minted for initial liquidity [tx]. LP tokens have been locked until 1 Oct, 2022 [0xb81d77...61dc].
• Both the vault and each of its strategies are upgradeable proxies. ⚠️The strategies implementations are not verified.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

The project implements an individual contract for each farm and pool. These contracts interact with the same vault. It is a multi-chain platform and 🚨 unfortunately a few contracts are found unverified on some of the chains [ex BSC, OKC]. In most implementations, the same code is implemented, but in some the blacklist functionality is added.

Although, taking into account the amount of resources that we should allocate to the review of each of the contracts of each of the chains, and considering that the review may not be valid for future pools added, we would initially rate the project as [not eligible] but considering the below, the rating will be [high risk].

• 🚨 Receipt Tokens Ownership has not been renounced.
• 🚨 Vault Ownership has not been renounced.
• 🚨 Funds deposited in the vault can be withdrawn by the gov (or from any address that is given the whitdraw role) at any time directly and/or indirectly.
• 🚨Vault contract can be paused.
• 🚨 Users can be blacklisted and unable to make new deposits and withdraw previously made deposits.
• ⚠️ Project uses its own router which seems to be a fork of Uniswap V2 (0.225% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here:
  • AVAX 0x14f800...9895
  • BSC 0x6A1A6B...4F01
  • ETH 0x69cd48...39e0
  • HECO 0x00efb9...a694
  • OKC 0x56cdde...1707

Algostable project which appears to be based on Tomb Finance project. We recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks. The codebases tend to be large and complex with various risk vectors. We are classifying the whole Project as [Not Eligible].

• ⚠️ Not KYC'd with RugDoc
• ⚠️ No reputable audits as of date
• ⚠️ Liquidity is not locked with RugDoc
• ⚠️ Not in a multisig. We highly recommend the project to use one with community members or reliable 3rd parties as an approver due to the said governance risk.

🚨  We want to be VERY clear that this review and it's rating ONLY applies to the genesis staking contract and not the actual operations of anything that happens anytime after genesis pools 🚨

Genesis Contract Review

• 🚨🚨🚨🚨Contains hard rug code🚨🚨🚨🚨
• ⚠️ Does not account for transfer-tax tokens. Withdraw is prone to reentrancy attacks in case of vulnerable tokens
• 🚨🚨🚨🚨 Governance can drain the contract after set was called🚨🚨🚨🚨
• 🚨🚨🚨🚨Withdraw will drain the brando token out of the contract after set was called, all other tokens(AVAX etc) wont be withdrawable.🚨🚨🚨🚨
• ✅ Token Ownership renounced
• ✅ Token Operator = Treasury
• ✅ Fixed 0.5% Genesis Pool Deposit Fee
• ✅ TaxOffice Ownership renounced (TransferTax is set to 0%)
• Genesis is running for 1 day

⚠️ TRIPLE CHECK the contract you interact with. Make sure it matches the one reviewed here (0xd680...065e)