Detailed Instructions

Begin by exhaustively mapping the protocol architecture. This is not just about the main farm contract; you must identify all interacting components. Start with the project's official documentation, GitHub repository, and blockchain explorers like Etherscan or BscScan for the contract addresses.

• Sub-step 1: Locate Core Contracts: Find the addresses for the staking/farming contract, the reward token contract, and the LP token or vault contract. For example, a farm might interact with a Uniswap V2 pair at 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D.
• Sub-step 2: Trace Dependencies: Use the Read Contract tab on Etherscan to find linked contracts, such as the reward distributor, timelock controller, or proxy admin. Note any upgradeable proxy patterns (e.g., TransparentProxy, UUPS).
• Sub-step 3: Verify Source Code: Compare the verified source code on-chain with the repository. Check for commit history and the last update date to assess maintenance.

Tip: Use a tool like tenderly.co to visualize the contract interaction flow and call traces for a complete dependency graph.

Detailed Instructions

Conduct a line-by-line code review focusing on the contract's business logic and common vulnerability patterns. Use static analysis tools like Slither or MythX for an initial scan, but manual review is critical for complex economic logic.

• Sub-step 1: Check for Common Vulnerabilities: Audit for reentrancy, integer overflows/underflows (though largely mitigated by Solidity 0.8+), access control issues, and flash loan attack vectors. Examine the safeTransfer usage and approval patterns.
• Sub-step 2: Analyze Reward Math: Scrutinize the reward emission logic. Calculate the Annual Percentage Yield (APY) formula yourself. Check for precision errors in division and ensure reward accrual uses a perSecond or perBlock rate that is correctly set. For example:

solidityCopy
// Calculate rewards per second for a 1,000,000 token emission over 30 days
uint256 rewardsPerSecond = 1000000 * 1e18 / (30 days * 86400 seconds);

• Sub-step 3: Review Emergency Functions: Identify pause mechanisms, withdrawal functions for stuck funds, and governance or admin privileges. Ensure there are timelocks on critical functions.

Tip: Pay special attention to any external calls to unaudited or complex DeFi primitives, as they introduce systemic risk.

Detailed Instructions

Model the economic sustainability of the yield source. High APYs are often funded by inflation or fees; you must determine if they are real or ponzinomic.

• Sub-step 1: Trace the Reward Source: Determine if rewards come from protocol fees, token inflation, or another external source. Check the reward token's total supply, emission schedule, and vesting. A contract minting 100 tokens per block with no cap is unsustainable.
• Sub-step 2: Calculate Real Yield vs. Inflation: Differentiate between yield from fee revenue (e.g., 0.3% of swap fees) and yield from token emissions. Use on-chain data to see if the treasury or reward wallet has sufficient funds. For a pool with $10M TVL and 100% APY, it would need $10M in annual rewards.
• Sub-step 3: Simulate Attack Vectors: Model whale deposit/withdrawal impacts on APY, impermanent loss for LP providers, and flash loan-enabled pump-and-dump schemes on the reward token.

Tip: Use a spreadsheet to project token emissions against market cap and trading volume. A daily emission exceeding 1-2% of the daily volume is a major red flag.

Detailed Instructions

Move from theoretical analysis to empirical on-chain verification. The blockchain ledger provides an immutable record of all interactions, which is the ultimate truth.

• Sub-step 1: Analyze Contract Activity: Use Etherscan's "Transactions" and "Internal Txns" tabs. Look for large, suspicious deposits/withdrawals, failed transactions, or interactions with known exploit contracts. Check if the Total Value Locked (TVL) on DeFiLlama matches the contract's internal accounting.
• Sub-step 2: Verify Admin Actions: Review the timelock contract's (e.g., 0x8E0B8c8BB9db49a46697F3a5Bb8A308e744821D2) transaction history for any recent proposals or executions that change parameters.
• Sub-step 3: Test Key Functions: Perform a small, live test interaction. For example, stake a minimal amount and then immediately withdraw to check for withdrawal fees or unexpected locks. You can simulate this with a call using cast from Foundry:

bashCopy
cast call <FARM_ADDRESS> "balanceOf(address)(uint256)" <YOUR_ADDRESS>

Tip: Correlate major contract events (like reward rate changes) with price action of the farm token to identify potential insider activity or governance manipulation.