Exchange

Goose fork Masterchef with a Uniswap fork AMM

• ⚠️ Masterchef does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Initial liquidity is just staked in the masterchef and can be removed and dumped at any time. Please clarify with the project on liquidity locking or burning.
• ⚠️ Emergency withdraw function is prone to reentrancy.
• Project uses their own AMM which appears to be a fork of Uniswap/Sushiswap. The project has a swap fee that is ranging from 0.1% to 0.5% on top of the usual 0.2% platform fees
• No deposit/withdrawal fees
• Treasury/Dev/Investor address can be set to the zero address, which would block regular withdrawals and harvests
• Regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• An extra set of emission rewards are minted to the treasury address (20%), dev address (20%), investor address (10%)
• Paladin audit only covers the project's AMM.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1a41F...068B8)

PancakeSwap fork

• ⚠️ Masterchef does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Syrup token bug is still present when using the emergency withdraw function. Confirm that the project has no plans to use this token.
• ⚠️ LP token contracts are still unverified.
• ✅ Migrator code has been removed
• ✅ Masterchef behind a 6 hr timelock
• No deposit/withdrawal fees
• Project uses their own AMM which appears to be a clean fork of PancakeSwap. The project has the usual 0.2% platform fees
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• An extra 10% of emission rewards are minted to the dev address

⚠️ Triple check the contract you interact matches the one reviewed here (..fd2a)

PancakeSwap v1 fork on Fantom. Only the router and factory contracts were reviewed (for swapping and liquidity), no farming or staking contracts were reviewed.

Contracts are a clean fork of PancakeSwap v1, with the addition of tracking the amount of WFTM each user swaps in a separate custom treasury contract.

⚠️ The treasury contract can be updated, which could be used to prevent swaps involving WFTM from occurring.

Factory address: 0xdf0a0a62995ae821d7a5cf88c4112c395fc41358

Router address: 0x4449249f9eA4381608f568aD4F0D6D0486A42568

Triple check the contracts you interact with are the same as the ones listed here.

Established project on the Fantom chain. Masterchef is a Goose fork with capped deposit fees. AMM is a straightforward SushiSwap fork. This review only covers the ZooDex project.

• 🚨 ZooTrade contract is unverified. Given how established the project is, this is unlikely to contain rug code and more likely just an oversight, but err on the side of caution if you want to use that particular project. This contract is not involved if you are just farming, adding liquidity, or swapping on ZooDex.
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ Max 5% deposit fees
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• An extra 10% of emission rewards are minted to the dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x4135b37B...18b9)

AMM in Moonriver with a Goose fork farm contract

• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• No deposit fees
• Regular deposit/withdrawals will fail once all the rewards in the MasterChef has been distributed unless emissions and/or multipliers are set to zero
• 21.25% of emission rewards are transferred to the dev address
• Tokens are preminted to the Masterchef for reward distribution
• Project uses a reflective token for its farm rewards
• Router and Factory contracts are Uniswap V2 forks with minimal changes to the fees.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1f4b...343E6)

ViperSwap's MasterBreeder fork

• 🚨 Token and Router contracts are unverified. Buy/use at your own risk. Farm uses its own LP generated by the router/factory as well.
• ⚠️ 100% deposit/withdrawal fees possible
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Masterchef does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Masterchef allows the revision of last deposit/withdraw block of a specific user which could reset withdraw fees back to 25% if used with malicious intent.
• Withdrawal fee currently ranges from 25% down to 0.01% depending on how long the first deposit up to a max of 4 weeks. 8% fee is charged if regularly withdrawn after the block you have deposited. Emergency withdraw charges a fixed 25% fee whenever it is triggered.
• The masterchef has authorizable roles where it can have a 2nd owner and have other priveleged functions assigned to it.
• Token ownership can be reclaimed using the Masterchef
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• Regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• A total 20% of emission rewards are minted on top of the rewards to several addresses
• Rewards are locked up and are released slowly over time

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x2bb...9aa3e9)

Uniswap V2 fork

• As the project is an AMM that has its own router, it is highly advised to do a small swap transaction first to check that the router contract matches the one reviewed here.
• With slight modification on the protocol fees from 0.05% to 0.03%, if enabled.
• 0.3% Swap fees are the same with Uniswap V2.
• Router has an added a referral mechanism where each swap records referral information.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x95cB1888...07Fd8)

Balancer V2 fork: Balancer V2 is an extremely complex project with over 45 contract files. Since the protocol is exceptionally large and complex it would require too many of our resources to be able to give it a risk rating, audits for a project like this can be over 6 digits. We recommend the project to get an audit by a reputable auditor who can validate that there are no excessive governance privileges or potential backdoors.

Masterchef review:

• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Rewarder contract can be updated on pools to block withdrawals
• ✅ Migrator has been removed.
• ✅ Masterchef behind a 6 hr timelock
• Rewarder contract rewards users a different token if enabled.
• Treasury address can be set to the zero address, which would block regular withdrawals and harvests
• Regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• 12.8% of emission rewards are minted to the treasury address
• 30,868,867 tokens (~55%) are in a token vesting contract with a multi sig wallet as beneficiary

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x8166...faCfd3)

Uniswap V2 forked for its AMM / ViperSwap fork for Yield Farm

• Complete Uniswap fork for the exchange. With slight modification on the protocol fees. 0.3% Swap fees are the same with Uniswap.
• Yield farm is highly customized and some points that might be of the interest of users are:
• ⚠️ Emergency withdraw has a 25% fee if triggered.
• ⚠️ 100% deposit fees possible
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Token ownership can be reclaimed after transferring it to the Masterchef
• 25% withdraw fee that gets reduced over time to 0.5% over the course of 4 weeks.
• Uncapped user reward locking. (Example: 95% of rewards are locked until specified claiming time).
• Dev addresses can be set to the zero address, which would block regular deposits, withdrawals, and harvests
• Due to the degree of its customization, we will be marking this as Not Eligble until the project has undergone an audit with a reputable auditor to ensure the code safety.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xf15B7...F8Af2 / 0x75A75...6A037)

1Swap is a stablecoin AMM with staking in the Moonriver chain. Contracts of 1Swap seem to be a mix of everything. It's stablecoin swap and LP token contracts appear to be forks from Iron Finance's Iron Swap protocol without the withdrawal fees. The 1Swap token on the other hand is a complete fork of Compound Finance's COMP token with just a slight modification on total supply count to 1 billion tokens, while its staking contract is a modified SushiSwap MiniChefV2 fork and here are some points taken:

• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ Migrator has been removed.
• ✅ 0% deposit/withdrawal fees
• ✅ Masterchef behind a 12 hr timelock
• Uses the rewarder contract as well for multiple token rewards similar to SushiSwap farms, although disabled for now.

We are marking this as ineligble as we highly recommend this to get audited by a reputable auditor as the contracts contain complex statements and would require more time and resources to properly ascertain its long-term safety.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x2e8...67D6)

PancakeSwap fork AMM with a SafeMoon fork native token

• ⚠️ Token fees are not capped and could be set to any number.
• Token applies a deflationary tokenomics with 3% reflection fee and 2% liquification fee.
• Token is a complete SafeMoon fork with lower fees and increased total token supply.
• 43% of token supply has been burned, 20% appears to be in a locker contract, and 20% is in a DONK-BNB PCS V2 liquidity (60% of LP tokens under an unverified contract, 20% is burned).
• Router and factory is nearly the same as PancakeSwap except for the rebranding and the modified swap fees of 0.23%.
• Lastly, their yield farm still appears to be in development stage.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (Router - 0xe779...87030 / Token - 0x1f82a...de35c)

PancakeSwap fork with migrator removed, SYRUP bug fixed, its own AMM, and a max supply of 300,000,000 tokens. Only the farm and AMM were reviewed: "YETU pools" were not reviewed.

• ⚠️ Masterchef currently not behind a timelock. The owner of the contract has been hidden, which makes it harder for users to determine who owns it.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ No deposit fees
• Regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• AMM/Exchange is a perfect clone of PancakeSwap V2
• 1/10th of emission rewards minted to dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x7B0ef401...8Ed7)

SushiSwap fork with migrator removed. Uses its own AMM.

• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Rewarder contract can be updated on pools to block withdrawals
• ✅ No deposit fees
• AMM/Router is a perfect clone of SushiSwap's V2

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xa0e82975...8Dc5)

New AMM project in BSC that has integrated NFTs into its farming functionality, gives out bonuses in exchange for owning one. The project uses its own router and factory which appears to be forked from Uniswap V2 and their Masterchef contract is under a transparent upgradeable proxy which could literally update the implementation into any contract. Current Masterchef implementation address ends in f44d and seems to be quite custom made. The project has an ImmuneFi bounty, been audited by Peckshield and Inspex, and have a current partnership with Alpaca.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, or anything that is overly complex and requires tons of peer reviews/audits from top companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

The project uses a custom coded masterchef and is very different from other farms. Uses its own router and factory as well which seem to be a fork of the Uniswap V2 protocol with some changes to function overrides, brand renames, and only accepts FORM, USDT (ETH), and BUSD (BSC) on front-end. Project token appears to be a fork of connext's AnyswapV5ERC20 contract that has multi-chain capabilities.

It is highly recommended that they get audited by a reputable auditor to take note of any security issues that could compromise the project. We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

AMM is a Uniswap V2 fork.

• 0.3% fee. Half to LP, half to owner.
• ⚠️ Can lock Factory contract, preventing you from receiving LP tokens when you add liquidity.
• Has been around for almost 2 months without issue so far.

Masterchef is a Pancakeswap fork.

• ⚠️ 100% deposit fees possible
• 1/10 of emissions to dev
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ⚠️ Masterchef currently not behind a timelock
• Dog Park and Lottery not reviewed. Good luck.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (Ends in 2EDC)

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Panther fork

• 🚨 Solarbeam Vaults are not yet verified as of date of review
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Masterchef uses a forward contract to allow implementation of meta transactions (gasless). Should also be noted that the EIP behind this is still in the draft phase and could still contain vulnerabilities. Kindly take note of the security considerations.
• ⚠️ Token uses access roles in their contract (minter, pauser, rescuer, take fee, router). Please clarify with the project on token role assignments as there could be risk of the dev minting and dumping.
• ⚠️ Token transfers are pausable
• ✅ Max 10% deposit fees
• ✅ Masterchef correctly accounts for transfer taxes on any token pool
• Solarbeam Factory is a SushiSwap fork. It has 0.25% fees, 1/6th of which (0.0417%) go to the fee address
• Masterchef uses an operator role for allocation point update, enable/disable of meta transactions
• Masterchef regular withdrawals will fail once max supply is reached unless emissions and/or multipliers are set to zero
• 1/10th of emission rewards minted to dev address
• Harvest lockups max of 14 days
• No referrals
• No transfer tax (max 10%)
• No anti-whale (min 0.01%)
• Token rescuer role can retrieve any tokens that are in the token contract
• Token has 1 Billion max supply, 100,000 has been preminted
• Token uses the permit library to enable gasless transactions
• 42% of tokens allocated to the vaults as rewards, 0.37% are supplied as liquidity and 97% of the LP tokens are held by the Masterchef

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xf03b...aa30907)

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Goose fork with capped deposit fees and a custom AMM. Farm start time/block is unknown.

• ⚠️ Liquidity pairs have been staked by the dev in the masterchef and can be withdrawn and dumped at any time. The dev also distributed BOURBON to 10 different addresses before adding liquidity. Please clarify with the project on liquidity management.
• ⚠️ Project uses its own AMM for creating liquidity pairs and trading. It is a clone of PancakeSwap v2.
• ⚠️ Emissions are zero, the farm will need to be started manually. Please clarify with the project on farm start time/block.
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• ✅ Max 10% deposit fees
• All BOURBON have already been minted (total supply 1,789) and ownership of the token has been renounced. The masterchef will not mint tokens but will distribute whatever it has left in its balance as rewards.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xbad57d9c...d354)