[WP-H3] saleRecipient can rug buyers

Lines of code Vulnerability details In TokenSaleUpgradeable.solbuy, tokenIn will be transferred from the buyer directly to the saleRecipient without requiring/locking/releasing the correspoining amount of tokenOut. This allows the saleRecipient to rug the users simply by not transferring tokenOut...

Sales end time can be postponed indefinitely

Lines of code Vulnerability details Impact Both setSaleStart and setSaleDuration allow owner to postpone the end time of a sale, which make it possible for a token sales be lengthened indefinitely. In such case buyer will never be able to claim. Since the README file specified "Rug Vectors" in th...

Possible rug #2

Lines of code Vulnerability details Impact The finalize function can be called only by the owner. Thus, if an owner account is lost, unable to send a transaction, or controlled by a bad actor, the contract may not get finalized. Thus the claim function will never be able to succeed and funds will...