# NeverSwap Security Assessment by [@fbsloXBT](https://twitter.com/fbsloXBT) --- Intro: NeverSwap seems to be a fork of Iron Finance. I am not a professional solidity auditor, this audit is for internal & educational use only, not financial advice, do your own research before investing. --- Docs: https://docs.neverswap.com/ Audited contracts (more info: https://docs.neverswap.com/smart-contract-address): --- - Ever Token (EVE): Stablecoin: https://bscscan.com/address/0x48Ea7cBabc983E4D0d67B8b2578B5eA665f40DFB - NEVER (governance): https://bscscan.com/address/0x1137D5836ef0E0ed9aCc74AeF8ffe2eAf81120b5 - NEVER-BUSD (LPs Token): https://bscscan.com/address/0x5f33ca991dd2362c8187bb71be089b51a7d5414a --- - Farm: https://bscscan.com/address/0x8fb60dd3557c491e04d00a06fdc0618423a3c618 - Timelock: https://bscscan.com/address/0x2e2cb8e50e488ab0695ac1da7c5ec00fb78ea578 - EVE minting: https://bscscan.com/address/0x761B25bC068a047A4A53eB9A12D89519da42aaE0 - Router: https://bscscan.com/address/0x29A3Ea9fE2fc3CF8fd27d42dE4d12f022a25B326 - Factory: https://bscscan.com/address/0x6D29AE56e3dCe38531C100b3A5E7ff61ca30A534 - Collateral oracle: https://bscscan.com/address/0xcBb98864Ef56E9042e7d2efef76141f15731B82f - Price oracle: https://bscscan.com/address/0x442c19cE325025DceDe70bF894cf2C8aC3726fAC --- EVE token: Standard Open-Zeppelin burnable, ownable, and mintable ERC20 contract. The owner is https://bscscan.com/address/0x761b25bc068a047a4a53eb9a12d89519da42aae0 (EVE minting contract), it can mint new tokens. ✅ No vulnerabilities found --- NEVER token: Non-standard ERC20, it has possible anti-whale limits on transactions, the owner can set max transfer amount, with minimum 0.1 NEVER per tx. Whitelisted addresses are excluded. Owner is another contract https://bscscan.com/address/0x8fb60dd3557c491e04d00a06fdc0618423a3c618 (farm contract), owner of which is Timelock (only 12h delay). ✅ No vulnerabilities found --- NEVER-BUSD LP token: Fork of Uniswap LP tokens, looks safe. ✅ No vulnerabilities found --- Farm: Standard yield farming contract (Sushi, Pancakeswap...), no migrator functions, the owner is timelock. It's minting ~0.15 NEVER/block.\ ✅ No vulnerabilities found --- Timelock: Standart timelock, 12h (43200 seconds) delay. Minimum delay is 12h, maximum is 30 days. ✅ No vulnerabilities found --- EVE minting: Oracle is required to get price of BUSD, it's powered by Chainlink. Owner can pause redeeming and minting! Maximum minting and redemption fee is 1%. If share price (NEVER) or stablecoin price ever reaches 0, redemption won't be possible![](https://i.imgur.com/qd5eN0P.png) ⚠ Possible issues found --- Router: Fork of Uniswap v2 router. ✅ No vulnerabilities found --- Factory: Fork of Uniswap v2 factory. ✅ No vulnerabilities found --- Collateral oracle: Used to get BUSD price, contract deployed over 130 days ago. Looks like it's Chainlink oracle: https://data.chain.link/bsc/mainnet/crypto-usd/busd-usd ✅ No vulnerabilities found --- Price oracle: Used to get NEVER price. Fork of Uniswap Oracle. ✅ No vulnerabilities found --- ## Summary: Critical issues found: 0 Medium issues found: 1 Price oracle is set to 30 seconds, which reduces the chance of similar collapse. For more info, read: https://nullscientist.medium.com/iron-finance-debacle-was-it-really-a-bank-run-no-dcf95dfcacdf Even if NEVER drops to 0, LP providers in EVE-stablecoin pairs only lose 10.55% of their deposit, since it's 80% backed by BUSD. ![](https://i.imgur.com/oKswQUY.png) <sup>Source: https://decentyields.com/impermanent-loss-calculator</sup>