Bandex [Banana Index] Token

BananaIndex.contractSwap(uint256) (#529-583) sends eth to arbitrary user
Dangerous calls:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _taxWallets.marketing.transfer(marketingBalance) (#575)
- _taxWallets.dev.transfer(devBalance) (#578)
- _taxWallets.floorSupport.transfer(floorSupportBalance) (#581)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in BananaIndex._transfer(address,address,uint256) (#478-527):
External calls:
- contractSwap(contractTokenBalance) (#522)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(swapAmt,0,path,address(this),block.timestamp) (#546-552)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- antiSnipe.checkUser(from,to,amount) (#634-638)
External calls sending eth:
- contractSwap(contractTokenBalance) (#522)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _taxWallets.marketing.transfer(marketingBalance) (#575)
- _taxWallets.dev.transfer(devBalance) (#578)
- _taxWallets.floorSupport.transfer(floorSupportBalance) (#581)
State variables written after the call(s):
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- _liquidityHolders[from] = true (#588)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- _tOwned[address(this)] += feeAmount (#665)
- _tOwned[from] -= amount (#645)
- _tOwned[to] += amountReceived (#647)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- contractSwapEnabled = true (#593)
Apply the check-effects-interactions pattern.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Contract ownership is not renounced (belongs to a wallet)

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool).checked (#633) is a local variable never initialized
BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool).check (#634) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool) (#624-651) has external calls inside a loop: antiSnipe.checkUser(from,to,amount) (#634-638)
Favor pull over push strategy for external calls.

Additional information: link

Variable 'BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool).check (#634)' in BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool) (#624-651) potentially used before declaration: checked = check (#635)
Move all variable declarations prior to any usage of the variable, and ensure that reaching a variable declaration does not depend on some conditional if it is used unconditionally.

Additional information: link

renounceOwnership() should be declared external:
- BananaIndex.renounceOwnership() (#263-267)
transfer(address,uint256) should be declared external:
- BananaIndex.transfer(address,uint256) (#283-286)
approve(address,uint256) should be declared external:
- BananaIndex.approve(address,uint256) (#288-291)
approveContractContingency() should be declared external:
- BananaIndex.approveContractContingency() (#301-304)
setNewRouter(address) should be declared external:
- BananaIndex.setNewRouter(address) (#314-325)
isBlacklisted(address) should be declared external:
- BananaIndex.isBlacklisted(address) (#379-381)
getMaxTX() should be declared external:
- BananaIndex.getMaxTX() (#432-434)
getMaxWallet() should be declared external:
- BananaIndex.getMaxWallet() (#436-438)
enableTrading() should be declared external:
- BananaIndex.enableTrading() (#598-609)
Use the external attribute for functions never called from the contract.

Additional information: link

BananaIndex.contractSwap(uint256) (#529-583) performs a multiplication on the result of a division:
-toLiquify = ((contractTokenBalance * ratios.liquidity) / ratios.totalSwap) / 2 (#539)
-liquidityBalance = (amtBalance * toLiquify) / swapAmt (#555)
Consider ordering multiplication before division.

Additional information: link

Reentrancy in BananaIndex.enableTrading() (#598-609):
External calls:
- antiSnipe.setLaunch(lpPair,uint32(block.number),uint64(block.timestamp),_decimals) (#604)
State variables written after the call(s):
- tradingEnabled = true (#605)
Reentrancy in BananaIndex.transferOwner(address) (#248-261):
External calls:
- _finalizeTransfer(_owner,newOwner,balanceOf(_owner),false,false,false,true) (#255)
- antiSnipe.checkUser(from,to,amount) (#634-638)
State variables written after the call(s):
- _owner = newOwner (#258)
Apply the check-effects-interactions pattern.

Additional information: link

BananaIndex.contractSwap(uint256) (#529-583) ignores return value by dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool) (#624-651) ignores return value by antiSnipe.checkUser(from,to,amount) (#634-638)
Ensure that all the return values of the function calls are used.

Additional information: link

BananaIndex.setMaxTxPercent(uint256,uint256) (#422-425) should emit an event for:
- _maxTxAmount = (_tTotal * percent) / divisor (#424)
BananaIndex.setMaxWalletSize(uint256,uint256) (#427-430) should emit an event for:
- _maxWalletSize = (_tTotal * percent) / divisor (#429)
BananaIndex.setSwapSettings(uint256,uint256,uint256,uint256) (#440-443) should emit an event for:
- swapThreshold = (_tTotal * thresholdPercent) / thresholdDivisor (#441)
- swapAmount = (_tTotal * amountPercent) / amountDivisor (#442)
Emit an event for critical parameter changes.

Additional information: link

Reentrancy in BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool) (#624-651):
External calls:
- antiSnipe.checkUser(from,to,amount) (#634-638)
State variables written after the call(s):
- _tOwned[from] -= amount (#645)
- _tOwned[to] += amountReceived (#647)
- amountReceived = takeTaxes(from,buy,sell,amount) (#646)
- _tOwned[address(this)] += feeAmount (#665)
Reentrancy in BananaIndex.constructor() (#208-239):
External calls:
- lpPair = IFactoryV2(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#229)
State variables written after the call(s):
- _approve(_owner,address(dexRouter),type()(uint256).max) (#232)
- _allowances[sender][spender] = amount (#297)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#233)
- _allowances[sender][spender] = amount (#297)
- _isExcludedFromFees[_owner] = true (#235)
- _isExcludedFromFees[address(this)] = true (#236)
- _isExcludedFromFees[DEAD] = true (#237)
- _liquidityHolders[_owner] = true (#238)
- lpPairs[lpPair] = true (#230)
Reentrancy in BananaIndex.enableTrading() (#598-609):
External calls:
- antiSnipe.setLaunch(lpPair,uint32(block.number),uint64(block.timestamp),_decimals) (#604)
State variables written after the call(s):
- allowedPresaleExclusion = false (#606)
- swapAmount = (balanceOf(lpPair) * 25) / 10000 (#608)
- swapThreshold = (balanceOf(lpPair) * 10) / 10000 (#607)
Reentrancy in BananaIndex.setNewRouter(address) (#314-325):
External calls:
- lpPair = IFactoryV2(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#318)
State variables written after the call(s):
- _approve(address(this),address(dexRouter),type()(uint256).max) (#324)
- _allowances[sender][spender] = amount (#297)
- dexRouter = _newRouter (#323)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in BananaIndex._finalizeTransfer(address,address,uint256,bool,bool,bool,bool) (#624-651):
External calls:
- antiSnipe.checkUser(from,to,amount) (#634-638)
Event emitted after the call(s):
- Transfer(from,address(this),feeAmount) (#666)
- amountReceived = takeTaxes(from,buy,sell,amount) (#646)
- Transfer(from,to,amountReceived) (#649)
Reentrancy in BananaIndex._transfer(address,address,uint256) (#478-527):
External calls:
- contractSwap(contractTokenBalance) (#522)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(swapAmt,0,path,address(this),block.timestamp) (#546-552)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- antiSnipe.checkUser(from,to,amount) (#634-638)
External calls sending eth:
- contractSwap(contractTokenBalance) (#522)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _taxWallets.marketing.transfer(marketingBalance) (#575)
- _taxWallets.dev.transfer(devBalance) (#578)
- _taxWallets.floorSupport.transfer(floorSupportBalance) (#581)
Event emitted after the call(s):
- ContractSwapEnabledUpdated(true) (#594)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- Transfer(from,address(this),feeAmount) (#666)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- Transfer(from,to,amountReceived) (#649)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
Reentrancy in BananaIndex.constructor() (#208-239):
External calls:
- lpPair = IFactoryV2(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#229)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#298)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#233)
- Approval(sender,spender,amount) (#298)
- _approve(_owner,address(dexRouter),type()(uint256).max) (#232)
Reentrancy in BananaIndex.contractSwap(uint256) (#529-583):
External calls:
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(swapAmt,0,path,address(this),block.timestamp) (#546-552)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
External calls sending eth:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
Event emitted after the call(s):
- AutoLiquify(liquidityBalance,toLiquify) (#566)
Reentrancy in BananaIndex.setNewRouter(address) (#314-325):
External calls:
- lpPair = IFactoryV2(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#318)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#298)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#324)
Reentrancy in BananaIndex.transferOwner(address) (#248-261):
External calls:
- _finalizeTransfer(_owner,newOwner,balanceOf(_owner),false,false,false,true) (#255)
- antiSnipe.checkUser(from,to,amount) (#634-638)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#259)
Apply the check-effects-interactions pattern.

Additional information: link

BananaIndex.setLpPair(address,bool) (#327-339) uses timestamp for comparisons
Dangerous comparisons:
- timeSinceLastPair != 0 (#332)
- require(bool,string)(block.timestamp - timeSinceLastPair > 259200,3 Day cooldown.!) (#333)
Avoid relying on block.timestamp.

Additional information: link

BananaIndex.setLpPair(address,bool) (#327-339) compares to a boolean constant:
-enabled == false (#328)
Remove the equality to the boolean constant.

Additional information: link

BananaIndex._checkLiquidityAdd(address,address) (#585-596) has costly operations inside a loop:
- _hasLiqBeenAdded = true (#589)
BananaIndex._checkLiquidityAdd(address,address) (#585-596) has costly operations inside a loop:
- antiSnipe = AntiSnipe(address(this)) (#591)
BananaIndex._checkLiquidityAdd(address,address) (#585-596) has costly operations inside a loop:
- contractSwapEnabled = true (#593)
Use a local variable to hold the loop computation result.

Additional information: link

Pragma version>=0.6.0<0.9.0 (#2) is too complex
solc-0.8.13 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Function IRouter01.WETH() (#33) is not in mixedCase
Parameter BananaIndex.setProtectionSettings(bool,bool,bool,bool)._antiSnipe (#387) is not in mixedCase
Parameter BananaIndex.setProtectionSettings(bool,bool,bool,bool)._antiGas (#387) is not in mixedCase
Parameter BananaIndex.setProtectionSettings(bool,bool,bool,bool)._antiBlock (#387) is not in mixedCase
Parameter BananaIndex.setProtectionSettings(bool,bool,bool,bool)._algo (#387) is not in mixedCase
Constant BananaIndex.startingSupply (#124) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex._name (#126) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex._symbol (#127) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex._decimals (#128) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex._tTotal (#130) is not in UPPER_CASE_WITH_UNDERSCORES
Variable BananaIndex._taxRates (#146-150) is not in mixedCase
Variable BananaIndex._ratios (#152-158) is not in mixedCase
Constant BananaIndex.maxBuyTaxes (#160) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex.maxSellTaxes (#161) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex.maxTransferTaxes (#162) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BananaIndex.masterTaxDivisor (#163) is not in UPPER_CASE_WITH_UNDERSCORES
Variable BananaIndex._taxWallets (#175-179) is not in mixedCase
Variable BananaIndex._hasLiqBeenAdded (#190) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Reentrancy in BananaIndex._transfer(address,address,uint256) (#478-527):
External calls:
- contractSwap(contractTokenBalance) (#522)
- _taxWallets.marketing.transfer(marketingBalance) (#575)
- _taxWallets.dev.transfer(devBalance) (#578)
- _taxWallets.floorSupport.transfer(floorSupportBalance) (#581)
External calls sending eth:
- contractSwap(contractTokenBalance) (#522)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#558-565)
- _taxWallets.marketing.transfer(marketingBalance) (#575)
- _taxWallets.dev.transfer(devBalance) (#578)
- _taxWallets.floorSupport.transfer(floorSupportBalance) (#581)
State variables written after the call(s):
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- _hasLiqBeenAdded = true (#589)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- _liquidityHolders[from] = true (#588)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- _tOwned[address(this)] += feeAmount (#665)
- _tOwned[from] -= amount (#645)
- _tOwned[to] += amountReceived (#647)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- antiSnipe = AntiSnipe(address(this)) (#591)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- contractSwapEnabled = true (#593)
Event emitted after the call(s):
- ContractSwapEnabledUpdated(true) (#594)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- Transfer(from,address(this),feeAmount) (#666)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
- Transfer(from,to,amountReceived) (#649)
- _finalizeTransfer(from,to,amount,takeFee,buy,sell,other) (#526)
Apply the check-effects-interactions pattern.

Additional information: link

Variable IRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#45) is too similar to IRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#46)
Prevent variables from having similar names.

Additional information: link

BananaIndex.slitherConstructorConstantVariables() (#104-671) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#167)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

BananaIndex._rOwned (#108) is never used in BananaIndex (#104-671)
BananaIndex._isExcluded (#118) is never used in BananaIndex (#104-671)
BananaIndex._excluded (#119) is never used in BananaIndex (#104-671)
Remove unused state variables.

Additional information: link

Contract has 15% buy tax and 15% sell tax.
Taxes are suspiciously high (over 10%) and contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Average 30d number of PancakeSwap swaps is low.

Number of Binance Smart Chain (BSC) token holders is low.

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find KYC or doxxing proof

Unable to find whitepaper link on the website

Unable to find token on CoinHunt

Additional information: link

Token is not listed at Mobula.Finance

Additional information: link

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death