FarmersOnly

From the technical side of things, FarmersOnly has not taken the best steps in rectifying the issues identified in our audit report as their contracts had already been deployed to the Avalanche network and the project owner insisted against redeployment. This has resulted in the issues being acknowledged rather than resolved. However, we’ve worked together with the client to mitigate the risks of the high severity issue by adding a dummy pool that mints 50% of the tokens which can then be distributed to the other half of the pools. While the issue would initially have led to the Masterchef being drained of native tokens, this situation will no longer occur under proper management.

The main risk vector that remains is:

• The owner adds pools without adjusting the weight of the dummy pool properly leading to either too many or too little tokens being minted. In case too many were minted, the cap will be reached more quickly. In case too few were minted, the Masterchef will be drained of native tokens while the non-native and LP tokens remain safe.

In addition to the aforementioned risks, there is no reasonable guarantee that the protocol will be successful or profitable to the average investor. The native token often drops very rapidly after launch so we recommend you carefully do your research on the project and team and whether they are appropriate for you.

The following steps are recommended minimum checks you as a potential/current user should perform:

• Setting alerts for and monitoring Timelock transactions. This is especially useful to monitor the mitigation of issue #1.
• Ensuring that the contract you approve and stake in matches the one we audited. This can be done by comparing the address with the one present in the contracts page in our audit.
• Be aware of the risk that the native token’s value might drop rapidly simply due to the nature of yield farming. Carefully evaluating the team and project could help with assessing this.

  When using this protocol, the main risks you want to look out for are:

  1. Ensuring that the contracts you are interacting with matches the one we audited. This can be done by comparing the addresses with the one present in the contracts page in our audit.
  2. Our audits only cover code-related risks. Users will have to do their own due diligence on other aspects of the protocol such as the reputation of the team, the protocol’s tokenomics, and other aspects of the project that might be relevant.