CyberDAO Presale Contract Review

Review Date: 21 Dec 2021 18:53 UTC

Disclaimer: This is not an audit of any kind. Please do not call my code review an audit. These reviews are for entertainment & education purpose only and are not financial advice.

Basic Information

Contract Address: https://blockexplorer.boba.network/address/0x0aba698445c9Ff35AB966c811E8F5B730aC75034/contracts

aCYBER Token Address: https://blockexplorer.boba.network/address/0x641e3C61DBFc5C9eD8f620eb474271cd4439f7d5/contracts

Owner Address (Normal Wallet): https://blockexplorer.boba.network/address/0x71F4b2238fcbADFd9A03Eb0f7D91727ab470e9Ea/transactions

Treasury Wallet (same as Owner Address): https://blockexplorer.boba.network/address/0x71F4b2238fcbADFd9A03Eb0f7D91727ab470e9Ea/transactions

Interesting Point

1. The presale contract ownership is not renounced.

2. There are several variable’s value that can not be change once the contract has been created. These consist of
- FRAX Token Address (FRAX) = 0x7562f525106f5d54e891e005867bf489b5988cd9
- aCYBER Token Address (aCYBER) = 0x641e3c61dbfc5c9ed8f620eb474271cd4439f7d5
- Treasury Wallet (treasuryWallet)= 0x71f4b2238fcbadfd9a03eb0f7d91727ab470e9ea

Note: Treasury Wallet is an owner address which is a normal wallet not a contract

Contract Creation (Constructor)

3. setWhitelistSlots and setWhitelistSlot function can only be use by the owner at anytime. This allow the owner to individually set each of the user presale allocated amount both increasing and decreasing. This also indicate the total allocation amount of aCYBER.
(There is 682,090 aCYBER in presale contract at the time of writing this)

This means that each user will have different allocation amount set.
When open presale, total initial allocation for each user is guarantee to have aCYBER for buying and claiming.

setWhitelistSlots and setWhitelistSlot function

4. buy function allow user to use FRAX to exchange for aCYBER allocation which will need to be claim later. This can be use as many time as user want until the allocation is full.

Condition for using this function:
- Owner open the presale
- User have whitelist allocation plus extended sale amount if any
- Buy amount does not exceed total aCYBER allocation

When the user use this function the contract will transfer FRAX to owner wallet (treasury) at the rate of 2 FRAX per aCYBER. The contract then record the claimable amount of the user and total buy amount.

buy function

5. The owner can increase the amount that every user can buy with extendSale function at anytime . This allow the owner to increase the allocation cap for all user if needed.

extendSale function

6. claim function is a function the user can use to claim aCYBER at a specific amount. The user can claim only when the owner open for claim.

When the user claim, the contract send aCYBER to the user as much as the user has bought.

claim function

7. Owner can choose to open for claim at anytime with setCanClaim function. It doesn’t govern by time but user trigger.

setCanClaim function.

8. recoverLostToken can be used by owner to withdraw any token at full amount from the contract to the owner wallet.

recoverLostToken function

9. aCYBER token ownership is not renounced. Owner can mint unlimited amount of aCYBER token.

mint function in aCYBER.sol

aCYBER contract value

Closing Thought

1. This is a contract where all the user’s deposit funds (FRAX) are send directly to the owner wallet which is a normal wallet.
   So ONLY INVEST IF YOU TRUST THE DEVELOPER.
2. There is a risk of unlimited minting of aCYBER directly from token contract. This can cause a possible soft rug in the future, if handle improperly during the aCYBER to CYBER claiming process.
   (Note: There is no exchanging aCYBER to CYBER contract at the time of writing this)
3. There is a risk of owner not open claiming process. This make the user unable to claim aCYBER token.
4. Overall this is a simple and manual contract where funds goes to a normal wallet with the risk mention above.

Possible Rug Route

Here we demonstrate a possible way to hard-rug with this contract

1. Let people buy aCYBER in exchange of FRAX with buy function because all funds goes to owner address on deposit.
2. Owner don’t deploy CYBER liquidity or exchange aCYBER to CYBER contract.

Here we demonstrate a possible way to soft-rug with this contract

1. Let people buy aCYBER in exchange of FRAX with buy function
2. Deploy OHM fork normally and allow claiming of aCYBER to CYBER
3. Owner use unlimited minting of aCYBER via token minting then exchange all of them for CYBER and gradually dump minted CYBER to the market. (or can just mint CYBER if that is deployed and owner can mint)

If this helpful to you, you can tip me here
Tip Address [ERC20/BSC/AVAX(C-chain)/Polygon/FTM]
0xC1f2154ea0B0E5779Ff84bb11A5ed209Fd0741DF

Follow me in Twitter: https://twitter.com/indyza_

Join Olympians Discord for discussion and code review request in (#🛠│code-talk): https://discord.gg/ucQwJZEmwa