Yuchifun — Bonding Curve Contracts

Audit report published Oct 2025. EVM · Solidity.

Findings at a glance

Severity	Count
Medium	4
Low	4
Informational	2
Total	10

Summary

Safe Edges reviewed Yuchifun's Solidity bonding-curve contracts (FFactory, FRouter, FERC20 and Bonding) in 2025. Ten issues were identified: four Medium, four Low and two Informational, one of which is a gas optimisation. The Medium issues covered duplicate trading pairs, buys and sells without slippage protection, admin parameters without upper bounds, and the ERC-20 approve race condition. The original report did not record resolution statuses.

Read the full report (PDF).

Findings

Medium (4)

• M-01 Missing Check for Existing Pair in FFactory::createPair
• M-02 Lack of Slippage Protection in Bonding::sell and Bonding::buy Functions
• M-03 Missing Maximum Value Restrictions
• M-04 Race Condition Vulnerability in FERC20::approve Function

Low (4)

• L-01 Missing Token Address Validation in FFactory::createPair
• L-02 Missing Input Validation in Multiple Functions
• L-03 Stuck ETH in Bonding::buy Function
• L-04 Incorrect usage of AccessControl in upgradeable contracts

Informational (2)

• I-01 Use Ownable2StepUpgradeable for Ownership Transfers
• G-01 Validation of Pair Existence for Gas Optimization

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.