Exchange

Mummy Finance appears to be a multi-product platform that deals with NFTs, Staking, Vaults, and an exchange. Their main product is its DEX which handles low cost leveraged longs/shorts or a straight-swap of assets.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies. Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Goose fork

• ⚠️ Liquidity is just staked in the masterchef and can be removed and dumped at any time. Please clarify with the project on liquidity locking or burning
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable.
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.3% swap fee - There is a mismatch in the fees calculated by the router and those calculated by the pairs). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0xdbc473...7d91).
• ✅ No deposit fees
• ⚠️ Masterchef behind a 1 hr timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• Dev address can be set to the zero address, which would block regular withdrawals and harvests
• An extra 10% of emission rewards are minted to the dev address

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x1f5fd1...1cC4)

Solidly/Velodrome and Curve hybrid with some changes to the fees and mechanism from originals.

The Thena project removes various mechanisms and modifies some other functionalities of the original projects, so it is recommended to read the docs to understand how the parts that make up the project work (see docs).

They still dont have an audit on their contract. They do have a preliminary version dated Oct 28, 2022. Its uploaded to the project repository and is not available on the page of the company responsible for carrying it out (Crypton Studio), perhaps due to its status as " preview version" (link 1 | link 2).

• ⚠️ Project uses its own router which seems to be a fork of Solidly router. ⚠️ Factory contract an upgradeable proxy. ⚠️ Swaps can be blocked by pausing the Factory (see code). Pauser/Owner is currently a user wallet (0x993ae2...d693). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x20a304...8431).

Having said the above, we are classifying this as Not Eligible as we recommend these kind of projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks.

RugDoc KYC: Project owner has KYC’d to us, and has signalled his transparency and commitment to this project. We have also confirmed that the project owner has access to the privileged addresses of the project, and shall retain full responsibility over them and any actions taken by them.

Flair DEX is an upcoming Automated Market Maker and Decentralized Exchange.
It aims to provide support for low slippage swaps with Uniswap styled LP and Curve inspired guages. NFT holders will control the protocol, revenue, and token emissions with ve(3,3) NFTs

This project has not yet launched and does not yet have verified contracts.

Panther fork without referrals

• ⚠️ The liquidity has simply been sent to the Timelock contract. This can be withdrawn at any time. Please clarify with the project on liquidity locking or burning (txs).
• ✅ Max 10% deposit fees
• ✅ Masterchef behind a 24 hr timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• An 13.5% of emission rewards are minted to the dev and marketing address. ⚠️ Both rates can be increased by up to 200% each due to a bug in the code. This can cause deposits, withdrawals and harvests to fail.
• ⚠️ Masterchef contract may indicate rewarder contracts for additional rewards for each pool, but it is currently not in use. Please note that any errors in its implementation can block deposits, harvests and withdrawals (even emergency withdrawals).
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.25% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x16e71B...32Ad).
• Native Token uses role-based access control.
  • ✅ Only the Masterchef has Minter role.
  • ⚠️ Token transfers can be paused at any time by a user with pauser role, which in this case is the dev wallet.
  • ⚠️ Admin role is held by the Timelock contract. So there is a risk that it assigns the Minter role to any user wallet.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• No transfer tax
• No anti-whale
• Harvest lockups disabled (max 14 days)

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x9BA666...BDDD)

Metropolis Exchange is a TraderJoe V2 fork. As a decentralized exchange based on Liquidity Book, it provides the possibility to implement different strategies by providing liquidity on a given pair (see more). Being that it can be similar to how UniswapV3 works, it is worth clarifying that there are several points of difference and that they should be taken into account when interacting (see more).

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

HoudiniSwap is a project that claims to allow trading between multiple assets and multiple chains, using the Monero blockchain as an intermediary to provide a layer of anonymity. The functionality is similar to FixeFloat or similar services, in the sense that no smart contracts are used, instead the deposit by the user is made to a wallet controlled by the project, which then sends.

• ⚠️ RugDoc HIGHLY recommends thinking through all possible scenarios in these types of projects thoroughly and assessing your risk tolerance. DYOR.
• They have their own Token ($POOF: 0x888c...f57a), which is only found on the ETH chain:
  • ⚠️ Transfer can be blocked anytime by blacklisting
  • Initial liquidity locked until Feb 18, 2023 (see tx)
  • Max Supply: 100,000 tokens
  • PreMinted: 100%
  • Taxes: Buy 6% | Sell 6% | Transfer 2%
  • Other Significant Governance Privileges: owner can take out any token from the contract (unless it is the token itself), enable trading once, change all fee receiving addresses and change the ratio's at which these addresses receive fees.

Camelot is a complex multi-product project in Arbitrum that utilizes a master contract, CamelotMaster, which delegates user funds to different pools to earn both GRAIL and xGRAIL reward tokens. Currently, there are over 21 pools deployed under the master contract. Paladin audit seems to have covered most of the potential hard-rug risks or funds being stuck.

We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours.

Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.

Since our resources are stretched thin and we don’t have the funding for these kind of massive endeavors, we may pass on projects that meet this level of complexity. DYOR.

Panther fork without referrals

• ⚠️ Token owner is NOT Masterchef. There is a risk of the dev minting and dumping. Please clarify with the project on token ownership.
• ⚠️ As of time of review, Liquidity is not yet supplied and will be added only after their presale ends. Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.
• ⚠️ No pools have been added to the Masterchef. There is a risk of the contract being switched out.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• ✅ Max 2% deposit fees
• ⚠️ Masterchef currently not behind a timelock
• ✅ Correctly accounts for transfer taxes on any token pool
• An extra 10% of emission rewards are minted to the dev address
• ⚠️ Project uses its own router which seems to be a fork of PCS (0.5% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x842067...6F07).
• Harvest lockups up to 5 days

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x8F4Ed4...b66e)

• ⚠️ Liquidity is just staked in the masterchef and can be removed and dumped at any time. Please clarify with the project on liquidity locking or burning
• ⚠️ 100% deposit fees possible.
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added.
• ⚠️ Project uses its own router which seems to be a fork of PCS router (0.25% swap fee). Ensure that you perform a small test transaction first and check that the Router contract matches the one here (0x951111...99A7).
• ✅ Masterchef behind a 6 hr timelock (0xd8aa28...86f2)
• An extra 0.5% of emission rewards are minted to the referral contract address (0x13319b...2a6a)
• 5% transfer tax (max 10%)
• 0.5% referrals.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xab4d93...cc8d)

Having said the above, we are classifying this as Not Eligible as we recommend these kind of complex projects to pass reputable audits and KYC verifications as there is a risk of governance mishandling. Before investing, we also recommend users to conduct their own due diligence checks.

Level Finance is a decentralized and non-custodial perpetual DEX on BNB Chain.

It uses a set of custom contracts for the distribution of rewards (similar to a Masterchef). For other more specific functionalities, such as order creation, they are found in proxy contracts.

Taking into account the above, the project is classified as Not eligible. However, there are certain points that may interest you:

• Each pool has the possibility of distributing double rewards 🚨 A misconfigured (or malicious) reward contract can block deposits, regular withdrawals, and even emergency withdrawals.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• ✅ No deposit fees
• ✅ Masterchef behind a 12 hr timelock (0x360071...8625)
• ⚠️ Does not support deflationary/transfer-tax token pools, just clarify with project that none will be added
• The proxy admin of the proxy contracts, are behind a timelock (0x360071...8625); whose owner, in turn, is a multisig wallet (0x6023c6...c621)
• ⚠️ All the owners of the multi-signature wallet were funded by the same wallet:
  • Owner 1
  • Owner 2
  • Owner 3

Goose fork

• 🚨 Hard rug code not found, but the project is High Risk for the following reason:
  • 🚨 A misconfigured (or malicious) reward contract can block deposits, regular withdrawals, and even emergency withdrawals. None have been implemented at the time of this review.
• ⚠️ The token contract uses role-based access. Dev has renounced his admin and minter roles [tx1 | tx2]. Dev has also transferred ownership to a 24hs timelock [tx]. ⚠️ This, in turn, gives the admin role to the Timelock contract. ⚠️⚠️ Dev can recover the admin role through the timelock and grant himself the minter role again and dev can mint and dump.
• ⚠️ The dev still maintains his Pauser role which gives him the possibility to pause the Token contract. This would block both sales, regular transfers, harvests and regular withdrawals.
• ⚠️ 460K tokens have been pre-minted:
  • 20K have been pre-minted to the developer. Half has been used to add liquidity (tx). The rest is still in possession of it.
  • 90K have been pre-minted to a vesting contract that will start releasing in 23 days (tx).
  • 350K have been pre-minted to another vesting contract that will start releasing in 6 months (tx). ⚠️ These, unlike the previous one, will be fully released at the time of release.
• ⚠️ The owner can freely modify the percentage that is assigned to him from the generated rewards. It can be up to 100%, so the user would not receive anything when claiming them.
• ⚠️ Withdrawals and harvests will fail once max supply is reached unless emissions and/or multipliers are set to zero. Users will still be able to emergency withdraw though.
• ⚠️ Pending rewards will continue accumulating once max supply is reached, but none will actually be harvestable
• ⚠️ Masterchef currently not behind a timelock
• ⚠️ Project appears to be using its own router which seems to be a fork of PCS router (swap fee 0.3% - the swap fee can be modified individually for each pair, but in the router it is fixed at 0.3%, which can cause an inconsistency between both contracts in the event of a modification). Ensure that you perform a small test transaction first and check that the Router contract matches the one (0xb35485...178e)
• ✅ Max 10% deposit fees.
• ✅ Correctly accounts for transfer taxes on any token pool.
• No harvest lockups at the time of this review (max 14 days).

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xd5be49...c6c7)

PCS router and factory fork

Liquid Bolt Finance uses modified versions of the liquidity pair, factory, and router contracts. Said functionalities are used to grant rewards obtained through arbitrage produced in the event of a mismatch between the values of the assets.

The changes made are focused on swap rates, limitations on the execution of certain functionalities, etc. Docs indicates that the yield is obtained through arbitrage when using their software. At no time is it indicated who or who would be the users of this software, what type of software it is, or what the flow of earnings would be like.

Anyway, some things that may be of interest to you:

• 20% DevFee in swaps. ⚠️ It can be up to 50%
• ⚠️ Mint, Swap and Skim functions can be restricted for use by authorized users only. Burn function is free of restrictions, so it could break liquidity at any time without problems.
• Each liquidity pair can have a custom fee.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here:

• BSC:
  • Router | Factory
• POLYGON:
  • Router | Factory
• FTM:
  • Router | Factory

🚨🚨🚨 Uses an upgradeable proxy for all contracts, so it can swap out contracts to literally anything 🚨🚨🚨

🚨 Website has been down for hours and in the telegram group don't give answers about it.

BabelSwap is a new farm and exchange in BSC. Currently, they are conducting a public sale ⚠️ Presales are notoriously risky, kindly exercise caution when participating. Please clarify with the project on liquidity locking/burning once it is added.. Most of the contracts are not yet deployed.

Some comments that may be of interest.

• 🚨 Admin can withdraw from the pre-sale contract, any token at any time
  • 🚨 Unsold tokens can be minted by the admin himself.
  • ⚠️ Dev can pause swap.
• 🚨 Admin can mint Genesis NFT up to max supply
• 🚨 Admin can mint Genesis Tree NFT up to max supply.
• ⚠️ The admin cannot be changed or renounced in any of the above contracts, so these issues will be permanent.

Uniswap Router and Factory fork

• ⚠️ Simple Uniswap router and factory fork. No additions, changes or improvements.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x304E...E8E9)

Uniswap Router and Factory fork

• ⚠️ Simple Uniswap router fork. No additions, changes or improvements.
• The project is apparently focused on being an AMM.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0xD61d0B...9742)

Goose Fork

• ⚠️ Masterchef uses per-block emissions instead of per-time. This is an antipattern on networks that uses variable block timing.
• ⚠️ Masterchef currently not behind a timelock.
• ✅ Max 1% deposit fees.
• ✅ Token owner is MasterChef.
• ✅ Correctly accounts for transfer taxes on any token pool.
• 0.2% swap fees
• An extra 10% of emission rewards are minted to the dev address.

⚠️ TRIPLE CHECK the contract you interact with matches the one reviewed here (0x32d9...AD93)