Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
BabyBlackBear.addLiquidity(uint256,uint256) (#757-770) sends eth to arbitrary user
Dangerous calls:
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in BabyBlackBear._transfer(address,address,uint256) (#666-704):
External calls:
- swapAndLiquify(contractTokenBalance) (#688)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#688)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#691)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#699)
- finalAmount = takeFee(sender,recipient,amount) (#693-694)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#784)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.
BabyBlackBear.addLiquidity(uint256,uint256) (#757-770) ignores return value by uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
Ensure that all the return values of the function calls are used.
Additional information: link
BabyBlackBear.allowance(address,address).owner (#521) shadows:
- Ownable.owner() (#155-157) (function)
BabyBlackBear._approve(address,address,uint256).owner (#544) shadows:
- Ownable.owner() (#155-157) (function)
Rename the local variables that shadow another component.
Additional information: link
BabyBlackBear.setBuyTaxes(uint256,uint256,uint256) (#564-570) should emit an event for:
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyTeamFee) (#569)
BabyBlackBear.setSellTaxes(uint256,uint256,uint256) (#572-578) should emit an event for:
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellTeamFee) (#577)
BabyBlackBear.setDistributionSettings(uint256,uint256,uint256) (#580-586) should emit an event for:
- _liquidityShare = newLiquidityShare (#581)
- _teamShare = newTeamShare (#583)
- _totalDistributionShares = _liquidityShare.add(_marketingShare).add(_teamShare) (#585)
BabyBlackBear.setMaxTxAmount(uint256) (#588-590) should emit an event for:
- _maxTxAmount = maxTxAmount (#589)
BabyBlackBear.setWalletLimit(uint256) (#600-602) should emit an event for:
- _walletMax = newLimit (#601)
BabyBlackBear.setNumTokensBeforeSwap(uint256) (#604-606) should emit an event for:
- minimumTokensBeforeSwap = newLimit (#605)
Emit an event for critical parameter changes.
Additional information: link
BabyBlackBear.setMarketingWalletAddress(address).newAddress (#608) lacks a zero-check on :
- marketingWalletAddress = address(newAddress) (#609)
BabyBlackBear.setTeamWalletAddress(address).newAddress (#612) lacks a zero-check on :
- teamWalletAddress = address(newAddress) (#613)
Check that the address is not zero.
Additional information: link
Reentrancy in BabyBlackBear.changeRouterVersion(address) (#633-650):
External calls:
- newPairAddress = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#641-642)
State variables written after the call(s):
- isMarketPair[address(uniswapPair)] = true (#649)
- isWalletLimitExempt[address(uniswapPair)] = true (#648)
- uniswapPair = newPairAddress (#645)
- uniswapV2Router = _uniswapV2Router (#646)
Reentrancy in BabyBlackBear.constructor() (#471-499):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#475-476)
State variables written after the call(s):
- _allowances[address(this)][address(uniswapV2Router)] = _totalSupply (#479)
- _balances[_msgSender()] = _totalSupply (#497)
- _totalDistributionShares = _liquidityShare.add(_marketingShare).add(_teamShare) (#486)
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyTeamFee) (#484)
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellTeamFee) (#485)
- isExcludedFromFee[owner()] = true (#481)
- isExcludedFromFee[address(this)] = true (#482)
- isMarketPair[address(uniswapPair)] = true (#495)
- isTxLimitExempt[owner()] = true (#492)
- isTxLimitExempt[address(this)] = true (#493)
- isWalletLimitExempt[owner()] = true (#488)
- isWalletLimitExempt[address(uniswapPair)] = true (#489)
- isWalletLimitExempt[address(this)] = true (#490)
- uniswapV2Router = _uniswapV2Router (#478)
Reentrancy in BabyBlackBear.swapAndLiquify(uint256) (#713-735):
External calls:
- swapTokensForEth(tokensForSwap) (#718)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#728)
- recipient.transfer(amount) (#630)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#731)
- recipient.transfer(amount) (#630)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- _allowances[owner][spender] = amount (#548)
Reentrancy in BabyBlackBear.transferFrom(address,address,uint256) (#660-664):
External calls:
- _transfer(sender,recipient,amount) (#661)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
External calls sending eth:
- _transfer(sender,recipient,amount) (#661)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#662)
- _allowances[owner][spender] = amount (#548)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in BabyBlackBear._transfer(address,address,uint256) (#666-704):
External calls:
- swapAndLiquify(contractTokenBalance) (#688)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#688)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#785)
- finalAmount = takeFee(sender,recipient,amount) (#693-694)
- Transfer(sender,recipient,finalAmount) (#701)
Reentrancy in BabyBlackBear.constructor() (#471-499):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#475-476)
Event emitted after the call(s):
- Transfer(address(0),_msgSender(),_totalSupply) (#498)
Reentrancy in BabyBlackBear.swapAndLiquify(uint256) (#713-735):
External calls:
- swapTokensForEth(tokensForSwap) (#718)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#728)
- recipient.transfer(amount) (#630)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#731)
- recipient.transfer(amount) (#630)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#549)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
Reentrancy in BabyBlackBear.swapTokensForEth(uint256) (#737-755):
External calls:
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
Event emitted after the call(s):
- SwapTokensForETH(tokenAmount,path) (#754)
Reentrancy in BabyBlackBear.transferFrom(address,address,uint256) (#660-664):
External calls:
- _transfer(sender,recipient,amount) (#661)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#746-752)
External calls sending eth:
- _transfer(sender,recipient,amount) (#661)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#549)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#662)
Apply the check-effects-interactions pattern.
Additional information: link
Ownable.unlock() (#190-195) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(block.timestamp > _lockTime,Contract is locked until 7 days) (#192)
Avoid relying on block.timestamp.
Additional information: link
Address.isContract(address) (#86-95) uses assembly
- INLINE ASM (#93)
Address._functionCallWithValue(address,bytes,uint256,string) (#122-139) uses assembly
- INLINE ASM (#131-134)
Do not use evm assembly.
Additional information: link
Address._functionCallWithValue(address,bytes,uint256,string) (#122-139) is never used and should be removed
Address.functionCall(address,bytes) (#105-107) is never used and should be removed
Address.functionCall(address,bytes,string) (#109-111) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#113-115) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#117-120) is never used and should be removed
Address.isContract(address) (#86-95) is never used and should be removed
Address.sendValue(address,uint256) (#97-103) is never used and should be removed
Context._msgData() (#13-16) is never used and should be removed
SafeMath.mod(uint256,uint256) (#74-76) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (#78-81) is never used and should be removed
Remove unused functions.
Additional information: link
BabyBlackBear._totalSupply (#435) is set pre-construction with a non-constant function or state variable:
- 10000000000 * 10 ** _decimals
BabyBlackBear._maxTxAmount (#436) is set pre-construction with a non-constant function or state variable:
- 10000000000 * 10 ** _decimals
BabyBlackBear._walletMax (#437) is set pre-construction with a non-constant function or state variable:
- 10000000000 * 10 ** _decimals
BabyBlackBear.minimumTokensBeforeSwap (#438) is set pre-construction with a non-constant function or state variable:
- 100 * 10 ** _decimals
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in Address.sendValue(address,uint256) (#97-103):
- (success) = recipient.call{value: amount}() (#101)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#122-139):
- (success,returndata) = target.call{value: weiValue}(data) (#125)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IUniswapV2Pair.DOMAIN_SEPARATOR() (#229) is not in mixedCase
Function IUniswapV2Pair.PERMIT_TYPEHASH() (#230) is not in mixedCase
Function IUniswapV2Pair.MINIMUM_LIQUIDITY() (#246) is not in mixedCase
Function IUniswapV2Router01.WETH() (#265) is not in mixedCase
Parameter BabyBlackBear.setSwapAndLiquifyEnabled(bool)._enabled (#616) is not in mixedCase
Variable BabyBlackBear._balances (#411) is not in mixedCase
Variable BabyBlackBear._buyLiquidityFee (#419) is not in mixedCase
Variable BabyBlackBear._buyMarketingFee (#420) is not in mixedCase
Variable BabyBlackBear._buyTeamFee (#421) is not in mixedCase
Variable BabyBlackBear._sellLiquidityFee (#423) is not in mixedCase
Variable BabyBlackBear._sellMarketingFee (#424) is not in mixedCase
Variable BabyBlackBear._sellTeamFee (#425) is not in mixedCase
Variable BabyBlackBear._liquidityShare (#427) is not in mixedCase
Variable BabyBlackBear._marketingShare (#428) is not in mixedCase
Variable BabyBlackBear._teamShare (#429) is not in mixedCase
Variable BabyBlackBear._totalTaxIfBuying (#431) is not in mixedCase
Variable BabyBlackBear._totalTaxIfSelling (#432) is not in mixedCase
Variable BabyBlackBear._totalDistributionShares (#433) is not in mixedCase
Variable BabyBlackBear._maxTxAmount (#436) is not in mixedCase
Variable BabyBlackBear._walletMax (#437) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Redundant expression "this (#14)" inContext (#7-17)
Remove redundant statements if they congest code but offer no value.
Additional information: link
Reentrancy in BabyBlackBear._transfer(address,address,uint256) (#666-704):
External calls:
- swapAndLiquify(contractTokenBalance) (#688)
- recipient.transfer(amount) (#630)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#688)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#691)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#699)
- finalAmount = takeFee(sender,recipient,amount) (#693-694)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#784)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#785)
- finalAmount = takeFee(sender,recipient,amount) (#693-694)
- Transfer(sender,recipient,finalAmount) (#701)
Reentrancy in BabyBlackBear.swapAndLiquify(uint256) (#713-735):
External calls:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#728)
- recipient.transfer(amount) (#630)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#731)
- recipient.transfer(amount) (#630)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#728)
- recipient.transfer(amount) (#630)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#731)
- recipient.transfer(amount) (#630)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
- _allowances[owner][spender] = amount (#548)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#549)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#734)
Reentrancy in BabyBlackBear.transferFrom(address,address,uint256) (#660-664):
External calls:
- _transfer(sender,recipient,amount) (#661)
- recipient.transfer(amount) (#630)
External calls sending eth:
- _transfer(sender,recipient,amount) (#661)
- recipient.transfer(amount) (#630)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#762-769)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#662)
- _allowances[owner][spender] = amount (#548)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#549)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#662)
Apply the check-effects-interactions pattern.
Additional information: link
Variable IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#270) is too similar to IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#271)
Prevent variables from having similar names.
Additional information: link
BabyBlackBear.slitherConstructorVariables() (#398-792) uses literals with too many digits:
- deadAddress = 0x000000000000000000000000000000000000dEaD (#409)
BabyBlackBear.slitherConstructorVariables() (#398-792) uses literals with too many digits:
- _totalSupply = 10000000000 * 10 ** _decimals (#435)
BabyBlackBear.slitherConstructorVariables() (#398-792) uses literals with too many digits:
- _maxTxAmount = 10000000000 * 10 ** _decimals (#436)
BabyBlackBear.slitherConstructorVariables() (#398-792) uses literals with too many digits:
- _walletMax = 10000000000 * 10 ** _decimals (#437)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
BabyBlackBear._decimals (#405) should be constant
BabyBlackBear._name (#403) should be constant
BabyBlackBear._symbol (#404) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
waiveOwnership() should be declared external:
- Ownable.waiveOwnership() (#164-167)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#169-173)
getUnlockTime() should be declared external:
- Ownable.getUnlockTime() (#175-177)
getTime() should be declared external:
- Ownable.getTime() (#179-181)
lock(uint256) should be declared external:
- Ownable.lock(uint256) (#183-188)
unlock() should be declared external:
- Ownable.unlock() (#190-195)
name() should be declared external:
- BabyBlackBear.name() (#501-503)
symbol() should be declared external:
- BabyBlackBear.symbol() (#505-507)
decimals() should be declared external:
- BabyBlackBear.decimals() (#509-511)
totalSupply() should be declared external:
- BabyBlackBear.totalSupply() (#513-515)
allowance(address,address) should be declared external:
- BabyBlackBear.allowance(address,address) (#521-523)
increaseAllowance(address,uint256) should be declared external:
- BabyBlackBear.increaseAllowance(address,uint256) (#525-528)
decreaseAllowance(address,uint256) should be declared external:
- BabyBlackBear.decreaseAllowance(address,uint256) (#530-533)
minimumTokensBeforeSwapAmount() should be declared external:
- BabyBlackBear.minimumTokensBeforeSwapAmount() (#535-537)
approve(address,uint256) should be declared external:
- BabyBlackBear.approve(address,uint256) (#539-542)
setMarketPairStatus(address,bool) should be declared external:
- BabyBlackBear.setMarketPairStatus(address,bool) (#552-554)
setIsExcludedFromFee(address,bool) should be declared external:
- BabyBlackBear.setIsExcludedFromFee(address,bool) (#560-562)
setSwapAndLiquifyEnabled(bool) should be declared external:
- BabyBlackBear.setSwapAndLiquifyEnabled(bool) (#616-619)
setSwapAndLiquifyByLimitOnly(bool) should be declared external:
- BabyBlackBear.setSwapAndLiquifyByLimitOnly(bool) (#621-623)
getCirculatingSupply() should be declared external:
- BabyBlackBear.getCirculatingSupply() (#625-627)
changeRouterVersion(address) should be declared external:
- BabyBlackBear.changeRouterVersion(address) (#633-650)
transfer(address,uint256) should be declared external:
- BabyBlackBear.transfer(address,uint256) (#655-658)
transferFrom(address,address,uint256) should be declared external:
- BabyBlackBear.transferFrom(address,address,uint256) (#660-664)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts