Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
BabyBlastoiseInu.swapBack() (#517-561) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in BabyBlastoiseInu._transferFrom(address,address,uint256) (#447-480):
External calls:
- swapBack() (#459)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#528-534)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
External calls sending eth:
- swapBack() (#459)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#462)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#465)
- amountReceived = takeFee(sender,amount) (#464)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#499)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#290-301) ignores return value by REWARDS.transfer(shareholder,amount) (#296)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.
BabyBlastoiseInu.swapBack().tmpSuccess (#545) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
tmpSuccess = false (#547)
Fix or remove the writes.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.
Reentrancy in DividendDistributor.distributeDividend(address) (#290-301):
External calls:
- REWARDS.transfer(shareholder,amount) (#296)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#298)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#299)
Reentrancy in DividendDistributor.process(uint256) (#260-284):
External calls:
- distributeDividend(shareholders[currentIndex]) (#276)
- REWARDS.transfer(shareholder,amount) (#296)
State variables written after the call(s):
- currentIndex ++ (#281)
Reentrancy in DividendDistributor.setShare(address,uint256) (#224-238):
External calls:
- distributeDividend(shareholder) (#226)
- REWARDS.transfer(shareholder,amount) (#296)
State variables written after the call(s):
- shares[shareholder].amount = amount (#236)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#237)
Apply the check-effects-interactions pattern.
Additional information: link
BabyBlastoiseInu.swapBack() (#517-561) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
Ensure that all the return values of the function calls are used.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#219-222) should emit an event for:
- minPeriod = _minPeriod (#220)
- minDistribution = _minDistribution (#221)
BabyBlastoiseInu.setFees(uint256,uint256,uint256,uint256) (#581-588) should emit an event for:
- liquidityFee = _liquidityFee (#582)
- reflectionFee = _reflectionFee (#583)
- marketingFee = _marketingFee (#584)
- totalFee = _liquidityFee.add(_reflectionFee).add(_marketingFee) (#585)
BabyBlastoiseInu.setSwapBackSettings(bool,uint256) (#597-600) should emit an event for:
- swapThreshold = _amount (#599)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#100) lacks a zero-check on :
- owner = adr (#101)
BabyBlastoiseInu.setMarketingReciver(address)._marketingFeeReceiver (#590) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#591)
BabyBlastoiseInu.setLiquidityReciver(address)._autoLiquidityReceiver (#593) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#594)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#290-301) has external calls inside a loop: REWARDS.transfer(shareholder,amount) (#296)
Favor pull over push strategy for external calls.
Additional information: link
Reentrancy in BabyBlastoiseInu.constructor() (#386-408):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#388)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = _totalSupply (#389)
- approve(routerv2,_totalSupply) (#404)
- _allowances[msg.sender][spender] = amount (#421)
- approve(address(pair),_totalSupply) (#405)
- _allowances[msg.sender][spender] = amount (#421)
- _balances[msg.sender] = _totalSupply (#406)
- autoLiquidityReceiver = DEAD (#401)
- distributor = new DividendDistributor(address(router)) (#391)
- isDividendExempt[pair] = true (#397)
- isDividendExempt[address(this)] = true (#398)
- isDividendExempt[DEAD] = true (#399)
- isFeeExempt[msg.sender] = true (#393)
- isTxLimitExempt[msg.sender] = true (#394)
- marketingFeeReceiver = _marketingAdr (#402)
Reentrancy in DividendDistributor.deposit() (#240-258):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#247-252)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#257)
- totalDividends = totalDividends.add(amount) (#256)
Reentrancy in DividendDistributor.distributeDividend(address) (#290-301):
External calls:
- REWARDS.transfer(shareholder,amount) (#296)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#297)
Reentrancy in DividendDistributor.setShare(address,uint256) (#224-238):
External calls:
- distributeDividend(shareholder) (#226)
- REWARDS.transfer(shareholder,amount) (#296)
State variables written after the call(s):
- addShareholder(shareholder) (#230)
- shareholderIndexes[shareholder] = shareholders.length (#322)
- removeShareholder(shareholder) (#232)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#328)
- addShareholder(shareholder) (#230)
- shareholders.push(shareholder) (#323)
- removeShareholder(shareholder) (#232)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#327)
- shareholders.pop() (#329)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#235)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in BabyBlastoiseInu._transferFrom(address,address,uint256) (#447-480):
External calls:
- swapBack() (#459)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#528-534)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
- distributor.setShare(sender,_balances[sender]) (#469)
- distributor.setShare(recipient,_balances[recipient]) (#473)
- distributor.process(distributorGas) (#476)
External calls sending eth:
- swapBack() (#459)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#478)
Reentrancy in BabyBlastoiseInu._transferFrom(address,address,uint256) (#447-480):
External calls:
- swapBack() (#459)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#528-534)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
External calls sending eth:
- swapBack() (#459)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#500)
- amountReceived = takeFee(sender,amount) (#464)
Reentrancy in BabyBlastoiseInu.constructor() (#386-408):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#388)
Event emitted after the call(s):
- Approval(msg.sender,spender,amount) (#422)
- approve(address(pair),_totalSupply) (#405)
- Approval(msg.sender,spender,amount) (#422)
- approve(routerv2,_totalSupply) (#404)
- Transfer(address(0),msg.sender,_totalSupply) (#407)
Reentrancy in BabyBlastoiseInu.swapBack() (#517-561):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#528-534)
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#544)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#550-557)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#559)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#285-288) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#286-287)
Avoid relying on block.timestamp.
Additional information: link
DividendDistributor.process(uint256) (#260-284) has costly operations inside a loop:
- currentIndex = 0 (#272)
DividendDistributor.distributeDividend(address) (#290-301) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#295)
DividendDistributor.process(uint256) (#260-284) has costly operations inside a loop:
- currentIndex ++ (#281)
Use a local variable to hold the loop computation result.
Additional information: link
BabyBlastoiseInu._maxTxAmount (#350) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 100 / 100
BabyBlastoiseInu._maxWalletToken (#353) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 3) / 100
BabyBlastoiseInu.swapThreshold (#382) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 10 / 10000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in BabyBlastoiseInu.swapBack() (#517-561):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#545)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#115) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#219) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#219) is not in mixedCase
Variable DividendDistributor._token (#171) is not in mixedCase
Variable DividendDistributor.REWARDS (#179) is not in mixedCase
Variable DividendDistributor.WBNB (#180) is not in mixedCase
Parameter BabyBlastoiseInu.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#581) is not in mixedCase
Parameter BabyBlastoiseInu.setFees(uint256,uint256,uint256,uint256)._reflectionFee (#581) is not in mixedCase
Parameter BabyBlastoiseInu.setFees(uint256,uint256,uint256,uint256)._marketingFee (#581) is not in mixedCase
Parameter BabyBlastoiseInu.setMarketingReciver(address)._marketingFeeReceiver (#590) is not in mixedCase
Parameter BabyBlastoiseInu.setLiquidityReciver(address)._autoLiquidityReceiver (#593) is not in mixedCase
Parameter BabyBlastoiseInu.setSwapBackSettings(bool,uint256)._enabled (#597) is not in mixedCase
Parameter BabyBlastoiseInu.setSwapBackSettings(bool,uint256)._amount (#597) is not in mixedCase
Parameter BabyBlastoiseInu.setDistributionCriteria(uint256,uint256)._minPeriod (#602) is not in mixedCase
Parameter BabyBlastoiseInu.setDistributionCriteria(uint256,uint256)._minDistribution (#602) is not in mixedCase
Variable BabyBlastoiseInu.REWARDS (#336) is not in mixedCase
Variable BabyBlastoiseInu.WBNB (#337) is not in mixedCase
Variable BabyBlastoiseInu.DEAD (#340) is not in mixedCase
Variable BabyBlastoiseInu.ZERO (#341) is not in mixedCase
Variable BabyBlastoiseInu._marketingAdr (#343) is not in mixedCase
Constant BabyBlastoiseInu._name (#345) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BabyBlastoiseInu._symbol (#346) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BabyBlastoiseInu._decimals (#347) is not in UPPER_CASE_WITH_UNDERSCORES
Variable BabyBlastoiseInu._totalSupply (#349) is not in mixedCase
Variable BabyBlastoiseInu._maxTxAmount (#350) is not in mixedCase
Variable BabyBlastoiseInu._maxWalletToken (#353) is not in mixedCase
Variable BabyBlastoiseInu._balances (#355) is not in mixedCase
Variable BabyBlastoiseInu._allowances (#356) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#120) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#121)
Prevent variables from having similar names.
Additional information: link
BabyBlastoiseInu.slitherConstructorVariables() (#333-626) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#340)
BabyBlastoiseInu.slitherConstructorVariables() (#333-626) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#341)
BabyBlastoiseInu.slitherConstructorVariables() (#333-626) uses literals with too many digits:
- distributorGas = 500000 (#379)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
BabyBlastoiseInu.REWARDS (#336) is never used in BabyBlastoiseInu (#333-626)
Remove unused state variables.
Additional information: link
BabyBlastoiseInu.DEAD (#340) should be constant
BabyBlastoiseInu.REWARDS (#336) should be constant
BabyBlastoiseInu.WBNB (#337) should be constant
BabyBlastoiseInu.ZERO (#341) should be constant
BabyBlastoiseInu._marketingAdr (#343) should be constant
BabyBlastoiseInu._totalSupply (#349) should be constant
BabyBlastoiseInu.feeDenominator (#367) should be constant
BabyBlastoiseInu.routerv2 (#338) should be constant
BabyBlastoiseInu.targetLiquidity (#372) should be constant
BabyBlastoiseInu.targetLiquidityDenominator (#373) should be constant
DividendDistributor.WBNB (#180) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#194) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#77-79)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#100-104)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts