Voltichange

Smart Contract Audit Report

Audit Summary

Voltichange Audit Report Voltichange is a new smart contract giving users the ability to interact with Uniswap with ease.

For this audit, we reviewed the project team's Voltichange contract at 0x269325c927e5eabb5bdc1a984fda6bc1a28cb5e1 on the Ethereum Mainnet.

We previously reviewed the project team's Volt Inu ETH token here and Volt Inu BSC token here.

Audit Findings

Informational findings were identified and the team may want to review them. In addition, centralized aspects are present.
Date: August 24th, 2022.

Finding #1 - Voltichange - Informational

Description: The swapTokenForETH() function gives the Uniswap Router the _amountIn value of allowance rather than the post-fee _amountInSub value.
Recommendation: The team should consider only granting the necessary amount of allowance.
Resolution: The team has not yet addressed this issue.

Finding #2 - Voltichange - Informational (Acknowledged)

Description: The whitelisted_tokens mapping is not used outside of adding and removing tokens.
Recommendation: The team should consider removing this mapping and the corresponding add and remove functions to lower contract size and deployment cost.
Resolution: The team has chosen to leave this mapping as they are using a Proxy and maintaining the same storage structure to prevent unintended effects.

Finding #3 - Voltichange - Informational (Acknowledged)

Description: The factory and deadAddress variables are unused and can safely be removed.
Recommendation: The team should consider removing these variables to lower contract size and deployment cost.
Resolution: The team has chosen to leave this mapping as they are using a Proxy and maintaining the same storage structure to prevent unintended effects.

Finding #4 - Voltichange - Informational (Acknowledged)

Description: The VOLT address variable is unused outside of the setter can safely be removed.
Recommendation: The team should consider removing this variables and its corresponding setter to lower contract size and deployment cost.
Resolution: The team has chosen to retain the VOLT address as it may be needed in the future.

Contract Overview

  • This contract is used to assist users with swapping tokens on Uniswap.
  • Users may swap any "In Token" for any other "Out Token".
  • A fee will be taken from the In Token and transferred to the Wallet address controlled by the team.
  • Users may swap native ETH for any Out Token.
  • A fee will be taken from the ETH and transferred to the Wallet address controlled by the team.
  • If users specify the Out Token to be the WETH address, the ETH will be deposited for WETH and transferred back to the user.
  • Users may swap any In Token for ETH.
  • A fee will be taken from the In Token and transferred to the Wallet address controlled by the team.
  • If users specify the In Token to be the WETH address, the WETH will be withdrawn for ETH and transferred back to the user.
  • All swaps will prioritize a direct swap between the In Token and Out Token if a direct pair exists. Otherwise, WETH will be used as an intermediary step in the swap's path.
  • Users must provide a minimum amount of tokens they would like to receive from the above swaps.
  • The contract provides built-in functionality to return the expected amount out, with and without fees, for specified tokens.
  • External users should ensure to not use this functionality and perform a swap in the same transaction as it allows for potential frontrunning.
  • Any address with the Admin role may transfer any ETH in the contract to a specified address at any time.
  • Any address with the Admin role may transfer any ERC20 token in the contract to a specified address at any time.
  • Any address with the Developer role may set the Wallet and VOLT addresses at any time.
  • Any address with the Developer role may add and remove a token from the Whitelist at any time.
  • Any address with the Developer role may set the current fees to any value at any time.
  • As the contract is implemented with Solidity v0.8.9, it is safe from any possible overflows/underflows.

    • Audit Results

    Vulnerability Category Notes Result
    Arbitrary Jump/Storage Write N/A PASS
    Centralization of Control The Developer role may set the fees to any value up to 100%. WARNING
    Compiler Issues N/A PASS
    Delegate Call to Untrusted Contract N/A PASS
    Dependence on Predictable Variables N/A PASS
    Ether/Token Theft N/A PASS
    Flash Loans N/A PASS
    Front Running N/A PASS
    Improper Events N/A PASS
    Improper Authorization Scheme N/A PASS
    Integer Over/Underflow N/A PASS
    Logical Issues N/A PASS
    Oracle Issues N/A PASS
    Outdated Compiler Version N/A PASS
    Race Conditions N/A PASS
    Reentrancy N/A PASS
    Signature Issues N/A PASS
    Unbounded Loops N/A PASS
    Unused Code The whitelisted_tokens mapping and factory, deadAddress, and VOLT variables can be safely removed. PASS
    Overall Contract Safety   PASS

    Inheritance Chart

    Smart Contract Audit - Inheritance

    Function Graph

    Smart Contract Audit - Graph

    Functions Overview

    
 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public

 + [Int] IAccessControlUpgradeable 
    - [Ext] hasRole
    - [Ext] getRoleAdmin
    - [Ext] grantRole #
    - [Ext] revokeRole #
    - [Ext] renounceRole #

 + [Lib] AddressUpgradeable 
    - [Int] isContract
    - [Int] sendValue #
    - [Int] functionCall #
    - [Int] functionCall #
    - [Int] functionCallWithValue #
    - [Int] functionCallWithValue #
    - [Int] functionStaticCall
    - [Int] functionStaticCall
    - [Int] verifyCallResult

 +  Initializable 
    - [Int] _disableInitializers #

 +  ContextUpgradeable (Initializable)
    - [Int] __Context_init #
       - modifiers: onlyInitializing
    - [Int] __Context_init_unchained #
       - modifiers: onlyInitializing
    - [Int] _msgSender
    - [Int] _msgData

 + [Lib] StringsUpgradeable 
    - [Int] toString
    - [Int] toHexString
    - [Int] toHexString
    - [Int] toHexString

 + [Int] IERC165Upgradeable 
    - [Ext] supportsInterface

 +  ERC165Upgradeable (Initializable, IERC165Upgradeable)
    - [Int] __ERC165_init #
       - modifiers: onlyInitializing
    - [Int] __ERC165_init_unchained #
       - modifiers: onlyInitializing
    - [Pub] supportsInterface

 +  AccessControlUpgradeable (Initializable, ContextUpgradeable, IAccessControlUpgradeable, ERC165Upgradeable)
    - [Int] __AccessControl_init #
       - modifiers: onlyInitializing
    - [Int] __AccessControl_init_unchained #
       - modifiers: onlyInitializing
    - [Pub] supportsInterface
    - [Pub] hasRole
    - [Int] _checkRole
    - [Int] _checkRole
    - [Pub] getRoleAdmin
    - [Pub] grantRole #
       - modifiers: onlyRole
    - [Pub] revokeRole #
       - modifiers: onlyRole
    - [Pub] renounceRole #
    - [Int] _setupRole #
    - [Int] _setRoleAdmin #
    - [Int] _grantRole #
    - [Int] _revokeRole #

 + [Int] IUniswapV2Router01 
    - [Ext] factory
    - [Ext] WETH
    - [Ext] addLiquidity #
    - [Ext] addLiquidityETH ($)
    - [Ext] removeLiquidity #
    - [Ext] removeLiquidityETH #
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)
    - [Ext] quote
    - [Ext] getAmountOut
    - [Ext] getAmountIn
    - [Ext] getAmountsOut
    - [Ext] getAmountsIn

 + [Int] IUniswapV2Router02 (IUniswapV2Router01)
    - [Ext] removeLiquidityETHSupportingFeeOnTransferTokens #
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #

 + [Int] IUniswapV2Factory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

 + [Int] IERC20 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] approve #
    - [Ext] allowance

 + [Int] IWETH 
    - [Ext] deposit ($)
    - [Ext] withdraw #

 +  Voltichange (AccessControlUpgradeable)
    - [Pub] initialize #
       - modifiers: initializer
    - [Ext] swapTokenForToken #
    - [Ext] swapETHforToken ($)
    - [Ext] swapTokenForETH #
    - [Ext] getPair
    - [Pub] getAmountOutMin
    - [Pub] getAmountOutMinWithoutFees
       - modifiers: onlyRole
    - [Int] createPath
    - [Ext] sendEthToAddr ($)
       - modifiers: onlyRole
    - [Ext] sendTokenToAddr #
       - modifiers: onlyRole
    - [Ext] setWallet #
       - modifiers: onlyRole
    - [Pub] addWhitelistAddr #
       - modifiers: onlyRole
    - [Pub] removeWhitelistAddr #
       - modifiers: onlyRole
    - [Ext] setFees #
       - modifiers: onlyRole
    - [Ext] setVoltAddr #
       - modifiers: onlyRole
    - [Pub] Constructor #
    - [Ext] Receive Ether ($)

    About SourceHat

    SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1300+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value across 1500 projects!.
    Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

    Contact us today to get a free quote for a smart contract audit of your project!

    What is a SourceHat Audit?

    Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

    How Do I Interpret the Findings?

    Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

    • High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
    • Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
    • Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
    • Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.