Review Date: 5 Dec 2021 10:13 UTC
Basic Information
Contract: https://ftmscan.com/address/0xd54f26d533b181eff11b78bcf154e558682bd9f5#code
Owner Address: https://ftmscan.com/address/0x6a42c2561d82d42abcd67da2eaf52f6f3ff15453
Payment Token Address (MIM): https://ftmscan.com/address/0x82f0b8b456c1a451378467398982d4834b6829c1
Reward Token Address (RedeemKnox(aKnox)): https://ftmscan.com/address/0x33ce3907a2ac48c34767455a20b0ddb05ac1b2a9
Interesting Point
1. The contract ownership is not renounced
2. aKnox Token contract is not Verified at the time of writing this review.
2. This contract use multiple file format which consist of Presale.sol, Address.sol, ERC20.sol, IERC20.sol, IOwnable.sol, Ownable.sol, SafeERC20.sol, and SafeMath.sol . Since most of this is a boilerplate (library) code, I’ll focus on the Presale.sol for this review.
Noted that there is nothing wrong about usage of Multiple file contract its just a preference of code convention of the developer.
3. buySomeToken function is use for user to trade MIM for aKnox token only when presale is open by the owner, the amount user bought is less than or equal to the remaining user allocation (remainingPayment), and there is still enough reward token (aKnox) remaining. The function didn’t exactly check if the user is whitelist but check for the remaining allocation instead.
When the user bought the buy with MIM (paymentToken), MIM is sent to the contract and the contract send aKnox (rewardToken) to the user immediately. There is no claiming needed since the buy already give you aKnox.
4. Total of 50,000,000 aKnox token is mint on the contract creation phase and send the owner, the owner then send 400,200 aKnox to the contract. So owner has a total of 49,599,800 aKnox remaining in the wallet. So if there is a trade of aKnox or liquidity available the owner can dump the remaining aKnox to the market on the other hand the owner can also use it to add liquidity.
Minted Txn: https://ftmscan.com/tx/0xb1d82ba06b0163f9504656fe62ba6224be20c0c3b409bfe78f178d2168d0ea8f
All Owner Transaction Txn: https://ftmscan.com/token/0x33ce3907a2ac48c34767455a20b0ddb05ac1b2a9?a=0x6a42c2561d82d42abcd67da2eaf52f6f3ff15453
5. retrievePayments function can only be use by the owner at anytime. The function send all MIM in the contract (paymentToken) to the owner wallet.
Closing Thought
1. This contract is similar to other contract where the owner can withdraw all funds from the contract at anytime using retrievePayments without going into a treasury, add liquidity or other well define use-case contract.
So ONLY INVEST IF YOU TRUST THE DEVELOPER.
2. The buying process give you the aKnox token right away so there is no risk in not able to get the aKnox process.
3. There is a risk of people starting to add aKnox liquidity and create a market although the amount of liquidity will be low.
4. There is a risk of owner adding the liquidity to the market and dump the aKnox gradually overtime since there is still 49,599,800 aKnox in the owner wallet.
5. No exchange aKnox for Knox token exist in the Presale contract unlike some other contract (E.g. aRome presale have an exchange function within the presale contract). So there is a risk of exchange contract not being created as well.
6. Overall this is a simple and short contract where user can buy MIM for aKnox with the possible risk mention above.
Possible Rug Route
Here we demonstrate a possible way to rug with this contract
- Let people buy aKnox in exchange of MIM with
buySomeTokenfunction - Owner use
retrievePaymentsto get all MIM into the owner address and the exchange aKnox for Knox is never created.
If this helpful to you, you can tip me here
Tip Address [ERC20/BSC/AVAX(C-chain)/Polygon/FTM]0xC1f2154ea0B0E5779Ff84bb11A5ed209Fd0741DF
Follow me in Twitter: https://twitter.com/indyza_
Join Olympians Discord for discussion and code review request in (#🛠│code-talk): https://discord.gg/MXpgrqtgzH
