# 审计报告

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mp5mNNUCC-wlUV%2F0.jpeg?generation=1607579503190311\&alt=media)

Preliminary Comments

Security Assessment

December 9th, 2020

Preliminary Report

For :

Gainswap team @ Gainswap

By :

Guilong Li @ CertiK

[guilong.li@certik.org](mailto:guilong.li@certik.org)

Bryan Xu @ CertiK

[buyun.xu@certik.org](mailto:buyun.xu@certik.org)

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mqCi15IwRC4Ku9%2F1.jpeg?generation=1607579503207056\&alt=media)

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mreOD83pxH3861%2F2.jpeg?generation=1607579503190363\&alt=media) **Disclaimer**

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mskuKywMcHu0b6%2F3.jpeg?generation=1607579503255909\&alt=media)

CertiK reports are not, nor should be considered, an “endorsement” or “disapproval” of any particular project or team. These reports are not, nor should be considered, an indication of the economics or value of any “product” or “asset” created by any team or project that contracts CertiK to perform a security review.

CertiK Reports do not provide any warranty or guarantee regarding the absolute bug-free nature of the technology analyzed, nor do they provide any indication of the technologies proprietors, business, business model or legal compliance.

CertiK Reports should not be used in any way to make decisions around investment or involvement with any particular project. These reports in no way provide investment advice, nor should be leveraged as investment advice of any sort.

CertiK Reports represent an extensive auditing process intending to help our customers increase the quality of their code while reducing the high level of risk presented by cryptographic tokens and blockchain technology.

Blockchain technology and cryptographic assets present a high level of ongoing risk. CertiK’s position is that each company and individual are responsible for their own due diligence and continuous security. CertiK’s goal is to help reduce the attack vectors and the high level of variance associated with utilizing new and consistently changing technologies, and in no way claims any guarantee of security or functionality of the technology we agree to analyze.

**What is a CertiK report?**

A document describing in detail an in depth analysis of a particular piece(s) of source code provided to CertiK by a Client.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mt-pdaENy6BBCI%2F4.jpeg?generation=1607579503195146\&alt=media)

An organized collection of testing results, analysis and inferences made about the structure, implementation and overall best practices of a particular piece of source code.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6muzONsNb4_vNN6%2F5.jpeg?generation=1607579503194872\&alt=media)

Representation that a Client of CertiK has indeed completed a round of auditing with the intention to increase the quality of the company/product’s IT infrastructure and or source code.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mvPp2qA0JTjuTW%2F6.jpeg?generation=1607579503190470\&alt=media)![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mw6VwhNCYp3snQ%2F7.jpeg?generation=1607579503193011\&alt=media)

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mxAut7uivOB_Bd%2F8.jpeg?generation=1607579503207206\&alt=media) **Overview**

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6myJlcMIlt0IXiM%2F9.jpeg?generation=1607579503210837\&alt=media)

**Project Summary**

| **Project Name** |   | [Gainswap Protocol](https://github.com/gainswap/gainswap)                                                                        |   |
| ---------------- | - | -------------------------------------------------------------------------------------------------------------------------------- | - |
|                  |   |                                                                                                                                  |   |
| **Description**  |   | a defi platform with swap and staking                                                                                            |   |
|                  |   | functionalities                                                                                                                  |   |
|                  |   |                                                                                                                                  |   |
| **Platform**     |   | Ethereum; Solidity                                                                                                               |   |
|                  |   |                                                                                                                                  |   |
| **Codebase**     |   | [GitHub Repository](https://github.com/gainswap/gainswap)                                                                        |   |
|                  |   |                                                                                                                                  |   |
| **Commit**       |   | [866ccbe7e1ed9007f5e32c784288537a01d1d29f](https://github.com/gainswap/gainswap/commit/866ccbe7e1ed9007f5e32c784288537a01d1d29f) |   |
|                  |   |                                                                                                                                  |   |

**Audit Summary**

| **Delivery Date**       | Dec. 9, 2020                   |
| ----------------------- | ------------------------------ |
|                         |                                |
| **Method of Audit**     | Static Analysis, Manual Review |
|                         |                                |
| **Consultants Engaged** | 2                              |
|                         |                                |
| **Timeline**            | Dec. 4, 2020 - Dec. 9, 2020    |
|                         |                                |

**Vulnerability Summary**

| **Total Issues**        | 11 |
| ----------------------- | -- |
|                         |    |
| **Total Critical**      | 0  |
|                         |    |
| **Total Major**         | 2  |
|                         |    |
| **Total Minor**         | 2  |
|                         |    |
| **Total Informational** | 7  |
|                         |    |
|                         |    |

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6mzCWRTzFWQl8sy%2F10.jpeg?generation=1607579503204007\&alt=media) **Executive Summary**

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n-9zNrAvmHCy3f%2F11.jpeg?generation=1607579503216738\&alt=media)

This report has been prepared for **Gainswap** protocol to discover issues and vulnerabilities in the

source code of their Smart Contract as well as any contract dependencies that were not part of an

officially recognized library. A comprehensive examination has been performed, utilizing Dynamic

Analysis, Static Analysis, and Manual Review techniques.

The auditing process pays special attention to the following considerations:

Testing the smart contracts against both common and uncommon attack vectors.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n0B3K-4ueI5pgF%2F12.jpeg?generation=1607579503204461\&alt=media)

Assessing the codebase to ensure compliance with current best practices and industry

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n1Y5K6H9_7Ovws%2F13.jpeg?generation=1607579503202037\&alt=media)

standards.

Ensuring contract logic meets the specifications and intentions of the client.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n2jkOISr25hPL8%2F14.jpeg?generation=1607579503216146\&alt=media)

Cross referencing contract structure and implementation against similar smart contracts

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n3gR8nnw-2kXrJ%2F15.jpeg?generation=1607579503209097\&alt=media)

produced by industry leaders.

Thorough line-by-line manual review of the entire codebase by industry experts.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n4QFC3GchRkPip%2F16.jpeg?generation=1607579503207103\&alt=media)

The files included in the scope were [GainswapFactory](https://github.com/gainswap/gainswap/blob/main/contract/GainswapFactory) and file

[GainswapRouter02](https://github.com/gainswap/gainswap/blob/main/contract/GainswapRouter02).

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n5jZgFdVexfQAq%2F17.jpeg?generation=1607579503190667\&alt=media)

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n6UNmI5MaDbnEa%2F18.jpeg?generation=1607579503209239\&alt=media) **Findings**

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n7GfDHKrrl0l5Q%2F19.jpeg?generation=1607579503226811\&alt=media)

| **ID** | **Title**                                    | **Type**     | **Severity**  |
| ------ | -------------------------------------------- | ------------ | ------------- |
|        |                                              |              |               |
| EXH-01 | Incorrect File Name                          | Optimization | Informational |
|        |                                              |              |               |
| EXH-02 | Compilation Issues                           | Compilation  | Major         |
|        |                                              |              |               |
| EXH-03 | Incorrect Naming Convention Utilization      | Coding Style | Informational |
|        |                                              |              |               |
| EXH-04 | Proper Usage of "public" and "external" type | Optimization | Informational |
|        |                                              |              |               |
| EXH-05 | Controversial specifications in whitepaper   | Optimization | Informational |
|        |                                              |              |               |
| EXH-06 | Security risk of transferring assets         | Security     | Major         |
|        |                                              |              |               |
| EXH-07 | Incorrect logic for \_withdraw0              | Optimization | Informational |
|        |                                              |              |               |
| EXH-08 | Math Overflow                                | Optimization | Minor         |
|        |                                              |              |               |
| EXH-09 | Missing Emit Events                          | Optimization | Minor         |
|        |                                              |              |               |
| EXH-10 | Gas Consumption                              | Optimization | Informational |
|        |                                              |              |               |
| EXH-11 | Check Zero Address                           | Optimization | Informational |
|        |                                              |              |               |
|        |                                              |              |               |

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n8dHD19YfcKliZ%2F20.jpeg?generation=1607579503210453\&alt=media)

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6n9dqb1msoBuWyo%2F21.jpeg?generation=1607579503213596\&alt=media) **Exhibit-01: Incorrect File Name**

| **Type**     | **Severity**  | **Location**                             |
| ------------ | ------------- | ---------------------------------------- |
|              |               |                                          |
| Optimization | Informational | GainswapFactory.sol,GainswapRouter02.sol |
|              |               |                                          |

**Description:**

There are no extension file names for file [GainswapFactory](https://github.com/gainswap/gainswap/blob/main/contract/GainswapFactory) and file

[GainswapRouter02](https://github.com/gainswap/gainswap/blob/main/contract/GainswapRouter02).

**Recommendation:**

We recommend to add the extension file name as below:

**GainswapFactory.sol**

**GainswapRouter02.sol**

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nADIygYP0fc4Dy%2F22.jpeg?generation=1607579503206836\&alt=media) **Exhibit-02: Compilation Issues**

| **Type**    | **Severity** | **Location**                             |
| ----------- | ------------ | ---------------------------------------- |
|             |              |                                          |
| Compilation | Major        | GainswapFactory.sol,GainswapRouter02.sol |
|             |              |                                          |

**Description:**

There several compilation issues

1. Contract code size exceeds 24576 bytes (a limit introduced in Spurious Dragon). This contract

may not be deployable on mainnet. Consider enabling the optimizer (with a low "runs"

value!), turning off revert strings, or using libraries.

1. Duplicate contract names found for IERC20, IGainswapFactory, SafeMathGainswap. This can

cause errors and unknown behavior. Please rename one of your contracts.

**Recommendation:**

We recommend to split the GainswapFactory contract and GainswapPair contract into different files.

**Exhibit-03: Incorrect Naming Convention Utilization**

| **Type** | **Severity**                     | **Location**                            |   |
| -------- | -------------------------------- | --------------------------------------- | - |
|          |                                  |                                         |   |
| Coding   | Informational                    | GainswapFactory.sol L440,L449,L575,L581 |   |
| Style    | GainswapRouter02.sol L20,L21,L38 |                                         |   |
|          |                                  |                                         |   |
|          |                                  |                                         |   |

**Description:**

Solidity defines a naming convention that should be followed. In general, parameters should use [mixedCase, refer to: https://solidity.readthedocs.io/en/v0.6.12/style-guide.html#naming-conventi](https://solidity.readthedocs.io/en/v0.6.12/style-guide.html%23naming-conventions) [ons](https://solidity.readthedocs.io/en/v0.6.12/style-guide.html%23naming-conventions)

Functions other than constructors should use mixedCase.

Examples:

Functions like: dummy\_mint() , dummy\_burn() , set\_redepositRatio0() ,

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nBwEfMbdeQop3b%2F23.jpeg?generation=1607579503214338\&alt=media)

set\_redepositRatio1() , DOMAIN\_SEPARATOR() , PERMIT\_TYPEHASH() , MINIMUM\_LIQUIDITY()

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nCrngYMYbhiJt7%2F24.jpeg?generation=1607579503331608\&alt=media)

Parameter shoud use mixedCase.

Examples:

Parameter like: \_redpositRatio0 , \_redpositRatio1

Inside each contract, library or interface, use the following order:

Type declarations

State variables

Events

Functions

Events definition should be in front of function definitions:

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nDkkCJfz_Afehr%2F25.jpeg?generation=1607579503216157\&alt=media)

event Sync(uint112 reserve0, uint112 reserve1);

event FeeUpdated(uint8 fee);

event Y0Updated(address indexed token);

event Y1Updated(address indexed token);

event Deposited0Updated(uint deposited);

event Deposited1Updated(uint deposited);

event RedepositRatio0Updated(uint16 ratio);

event RedepositRatio1Updated(uint16 ratio);

**Recommendation:**

The recommendations outlined here are intended to improve the readability, and thus they are

not rules, but rather guidelines to try and help convey the most information through the names

of things.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nE_HS_kHla6f16%2F26.jpeg?generation=1607579503199823\&alt=media) **Exhibit-04: Proper Usage of "public" and "external" type**

| **Type**     | **Severity**  | **Location**                                      |
| ------------ | ------------- | ------------------------------------------------- |
|              |               |                                                   |
| Optimization | Informational | GainswapFactory.sol L305,L310,L522,L525,L528,L533 |
|              |               |                                                   |

**Description:**

"public" functions that are never called by the contract could be declared "external" . When the inputs are arrays "external" functions are more efficient than "public" functions. Examples

Functions like : getDeposited() , getDummy() , unapprove0() , unapprove1() , setY0() , setY1()

**Recommendation:**

Consider using the "external" attribute for functions never called from the contract.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nFlG75BT5Kc6pM%2F27.jpeg?generation=1607579504214829\&alt=media) **Exhibit-05: Controversial specifications in whitepaper**

| **Type**     | **Severity**  | **Location**                                 |
| ------------ | ------------- | -------------------------------------------- |
|              |               |                                              |
| Optimization | Informational | [GainswapFactory.sol L501](broken-reference) |
|              |               |                                              |

**Description:**

According to the chapter 2.3 in doc

[gainswap.pdf](https://github.com/gainswap/gainswap/blob/main/gainswap.pdf), the fee is 0.30%.

This is effectively the same as letting anyone flash-borrow any of assets stored in a Gainswap pool (for the same 0.30% fee as Uniswap charges for trading).

But in chapter 3.3 in the doc :

The 30-base-point fee fixed on Uniswap can be negotiated and formulated by the community in Gainswap.That can be changed according to user needs when new situations appear.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nGk2D7wf95SEIb%2F28.jpeg?generation=1607579503210970\&alt=media)![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nHbvtApuIjoA4L%2F29.jpeg?generation=1607579503205097\&alt=media)![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nIVN4imfVkobFR%2F30.jpeg?generation=1607579503217868\&alt=media)![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nJQOsL414h-QJt%2F31.jpeg?generation=1607579503214795\&alt=media)

This is controversial with chapter 2.3.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nKrOhnicTZz27E%2F32.jpeg?generation=1607579503209018\&alt=media) **Exhibit-06: Security risk of transferring assets**

| **Type** | **Severity** | **Location**                                 |
| -------- | ------------ | -------------------------------------------- |
|          |              |                                              |
| Security | Major        | [GainswapFactory.sol L528](broken-reference) |
|          |              |                                              |

**Description:**

This protocol has an external dependency. User's digital currencies can be deposited to a third-party service (like YFI) via IyToken contract. The system should only be used if the service is appropriately trusted. IyToken contract is not in the scope of audit.

Additionally, the governace privilege should be controlled. yToken0 and yToken1 can be easily set by governace. This will change the address where user's digital currencies to be deposited.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nLVLwCfZog-Q1U%2F33.jpeg?generation=1607579503198688\&alt=media)

function setY0(address y) public onlyOwner() {

yToken0 = y;

emit Y0Updated(y);

approve0();

}

function setY1(address y) public onlyOwner() {

yToken1 = y;

emit Y1Updated(y);

approve1();

}

**Recommendation:**

We recommend to move the governace to Timelock or community after the protocol deployed.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nMykdi8qUAdnFq%2F34.jpeg?generation=1607579503215968\&alt=media) **Exhibit-07: Incorrect logic for \_withdraw0()**

| **Type**     | **Severity**  | **Location**                                 |
| ------------ | ------------- | -------------------------------------------- |
|              |               |                                              |
| Optimization | Informational | [GainswapFactory.sol L528](broken-reference) |
|              |               |                                              |

**Description:**

There are some corner cases not included by the logic in function \_withdraw0() .

1. delta could be greater than deposited0 even not withdraw all, since there is staking

rewards.

1. This function will transfer the staking rewards gained from IyToken to address feeTo .

Before using function setFeeTo() to set the destination, its initial value is the

GainswapFactory contract. Then liquidity providers could not share the rewards.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nNn4x0wXxwcSA1%2F35.jpeg?generation=1607579503217760\&alt=media)

function \_withdraw0(uint s) internal {

...

if (delta <= deposited0) {

deposited0 -= delta;

} else {

delta -= deposited0; deposited0 = 0;

\_safeTransfer(token0, owner(), delta);

}

...

}

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nOWbaGnsoweihv%2F36.jpeg?generation=1607579503211128\&alt=media) **Exhibit-08: Math Overflow**

| **Type**     | **Severity** | **Location**                                 |
| ------------ | ------------ | -------------------------------------------- |
|              |              |                                              |
| Optimization | Minor        | [GainswapFactory.sol L451](broken-reference) |
|              |              |                                              |

**Description:**

Function dummy\_burn() did not use safe math. This can cause sub overflow issue.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nP9rA8Ff3X4MxV%2F37.jpeg?generation=1607579503213657\&alt=media)

function dummy\_burn(uint amount0, uint amount1) external onlyOwner() lock {

(uint112 \_reserve0, uint112 \_reserve1,) = getReserves(); // gas savings

dummy0 -= uint112(amount0);

dummy1 -= uint112(amount1);

emit DummyBurn(amount0, amount1);

\_update(b0(), b1(), \_reserve0, \_reserve1);

}

**Recommendation:**

We recommend to use safe math instead of arithmetic operators.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nQMxvqPyB1YmFm%2F38.jpeg?generation=1607579503255899\&alt=media) **Exhibit-09: Missing Emit Events**

| **Type**     | **Severity** | **Location**                  |
| ------------ | ------------ | ----------------------------- |
|              |              |                               |
| Optimization | Minor        | GainswapFactory.sol L688,L693 |
|              |              |                               |

**Description:**

Several sensitive actions are defined without event declarations.

Examples:

Fucntions like setFeeTo() , setFeeToSetter() .

**Recommendation:**

Consider adding events for sensitive actions, and emit it in the function.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nRUJmfQiqQqfRz%2F39.jpeg?generation=1607579503204832\&alt=media) **Exhibit-10: Gas Consumption**

| **Type**     | **Severity**  | **Location**                    |
| ------------ | ------------- | ------------------------------- |
|              |               |                                 |
| Optimization | Informational | \[GainswapFactory.sol L322]\(#) |
|              |               |                                 |

**Description:**

In function \_safeTransfer() , require statements shoud be in front of the if

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nS0MW1Zsk35Ns9%2F40.jpeg?generation=1607579503215982\&alt=media)

(redepositRatio0 > 0){} code snipit.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nT4_p_9QOVrZUQ%2F41.jpeg?generation=1607579503215507\&alt=media)

if (token == token0) {

\_withdrawAll0();

(bool success, bytes memory data) =

token.call(abi.encodeWithSelector(SELECTOR, to, value));

if (redepositRatio0 > 0) {

redeposit0();

}

require(success && (data.length == 0 || abi.decode(data, (bool))),

'Gainswap: TRANSFER\_FAILED');

} else {

\_withdrawAll1();

(bool success, bytes memory data) =

token.call(abi.encodeWithSelector(SELECTOR, to, value));

if (redepositRatio1 > 0) {

redeposit1();

}

require(success && (data.length == 0 || abi.decode(data, (bool))),

'Gainswap: TRANSFER\_FAILED');

}

**Recommendation:**

We recommend to put the if (redepositRatio0 > 0){} code snipit in front of require statement.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nUvEYugI_-m9Dc%2F42.jpeg?generation=1607579503205250\&alt=media)

if (token == token0) {

\_withdrawAll0();

(bool success, bytes memory data) =

token.call(abi.encodeWithSelector(SELECTOR, to, value));

require(success && (data.length == 0 || abi.decode(data, (bool))),

'Gainswap: TRANSFER\_FAILED');

if (redepositRatio0 > 0) {

redeposit0();

}

} else {

\_withdrawAll1();

(bool success, bytes memory data) =

token.call(abi.encodeWithSelector(SELECTOR, to, value));

require(success && (data.length == 0 || abi.decode(data, (bool))),

'Gainswap: TRANSFER\_FAILED');

if (redepositRatio1 > 0) {

redeposit1();

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nVInL6C76TLB2N%2F43.jpeg?generation=1607579503208598\&alt=media)

}

}

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nWRTIdNHnQ1zZh%2F44.jpeg?generation=1607579503208509\&alt=media) **Exhibit-11: Check Zero Address**

| **Type**     | **Severity**  | **Location**                         |
| ------------ | ------------- | ------------------------------------ |
|              |               |                                      |
| Optimization | Informational | \[GainswapFactory.sol L528,L533]\(#) |
|              |               |                                      |

**Description:**

The parameter of address y is not checked for zero address in function setY0 and setY1 .

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nXSR9aaJaRRz7L%2F45.jpeg?generation=1607579503206650\&alt=media)![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nYNQvm0uR7OfOe%2F46.jpeg?generation=1607579503240716\&alt=media)

function setY0(address y) public onlyOwner() {

yToken0 = y;

emit Y0Updated(y);

approve0();

}

**Recommendation:**

We recommend to add below checks.

![](https://2296405157-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2Funisave-doc%2F-MOAAYu-wB4GQ5cBzz4L%2F-MOAC6nZZHb3L3ggCuv0%2F47.jpeg?generation=1607579503213729\&alt=media)

function setY0(address y) public onlyOwner() {

require(y != address(0), "Address zero is forbbiden");

yToken0 = y;

emit Y0Updated(y);

approve0();

}
