From the technical side of things, PolyFund has taken a few reasonable steps in rectifying the issues identified in our audit report, though a majority remain unresolved as their contracts have already been deployed to the Polygon network and the project owner does not seem keen on redeployment. As a result, the contracts are not entirely secure from a user’s perspective as there remains significant residual risk from vectors including but not limited to:
- Exploitation of the Masterchef contract if tokens with transfer taxes are added as pools.
- Users’ deposits and withdrawals reverting due to the Emission Oracle.
- Users’ deposits and withdrawals reverting when fee address is set to the zero address.
- Excessive token minting from referral rewards.
The points above above represent a small fraction, but are the most severe of issues that remain in the PolyFund contracts. Users wishing to interact with this project should exercise increased caution, and to monitor any queued Timelock transactions especially with regards to those concerning the Token and Masterchef.
In addition to the aforementioned risks, there is no reasonable guarantee that the protocol will be successful or profitable to the average investor. The native token often drops very rapidly after launch so we recommend you carefully do your research on the project and team and whether they are appropriate for you.
The following steps are recommended minimum checks you as a potential/current user should perform:
- Setting alerts for and monitoring Timelock transactions.
- Ensuring that the contract you approve and stake in matches the one we audited. This can be done by comparing the address with the one present in the contracts page in our audit.
- The risk that the native token’s value might drop rapidly simply due to the nature of yield farming. Carefully evaluating the team and project could help with assessing this.
High
Medium
Low
Informational