BabyDogeKingSon.swapBack() (#291-332) sends eth to arbitrary user
Dangerous calls:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Reentrancy in BabyDogeKingSon._transferFrom(address,address,uint256) (#234-257):
External calls:
- swapBack() (#245)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#302-308)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
External calls sending eth:
- swapBack() (#245)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
State variables written after the call(s):
- _balances[sender] = _balances[sender] - amount (#249)
- _balances[recipient] = _balances[recipient] + (amountReceived) (#253)
- amountReceived = takeFee(sender,amount) (#252)
- _balances[address(this)] = _balances[address(this)] + (feeAmount) (#278)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.
BabyDogeKingSon.takeFee(address,uint256) (#272-282) performs a multiplication on the result of a division:
-feeAmount = amount / 100 * actualFee (#276)
BabyDogeKingSon.slitherConstructorVariables() (#113-411) performs a multiplication on the result of a division:
-swapThreshold = _totalSupply / 10000 * 5 (#173)
Consider ordering multiplication before division.
Additional information: link
BabyDogeKingSon.swapBack() (#291-332) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
Ensure that all the return values of the function calls are used.
Additional information: link
BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256) (#374-382) should emit an event for:
- sellLpFee = _liquidityFee (#375)
- sellMarketingFee = _sellMarketingFee (#376)
- sellBuyBackFee = _sellBuybackFee (#377)
- sellTotalFee = _sellMarketingFee + _sellBuybackFee + _liquidityFee (#378)
- buyMarketingFee = _buyMarketingFee (#379)
- buyBuyBackFee = _buyBuybackFee (#380)
- buyTotalFee = _buyMarketingFee + _buyBuybackFee (#381)
Emit an event for critical parameter changes.
Additional information: link
BabyDogeKingSon.setFeeReceiver(address,address)._marketingFeeReceiver (#384) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#385)
BabyDogeKingSon.setFeeReceiver(address,address)._buybackFeeReceiver (#384) lacks a zero-check on :
- buybackFeeReceiver = _buybackFeeReceiver (#386)
Check that the address is not zero.
Additional information: link
Reentrancy in BabyDogeKingSon._transferFrom(address,address,uint256) (#234-257):
External calls:
- swapBack() (#245)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#302-308)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
External calls sending eth:
- swapBack() (#245)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
State variables written after the call(s):
- amountReceived = takeFee(sender,amount) (#252)
- actualFee = buyTotalFee (#274)
- actualFee = sellTotalFee (#275)
- launch() (#247)
- launchedAt = block.timestamp (#339)
Reentrancy in BabyDogeKingSon.constructor() (#178-198):
External calls:
- pair = IDEXFactory(router.factory()).createPair(address(this),router.WETH()) (#180)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#181)
- _balances[_owner] = _liqSupply (#194)
- _balances[_DEAD] = _burntSupply (#195)
- isFeeExempt[_owner] = true (#186)
- isFeeExempt[marketingFeeReceiver] = true (#187)
- isFeeExempt[buybackFeeReceiver] = true (#188)
- isTxLimitExempt[_owner] = true (#190)
- isTxLimitExempt[marketingFeeReceiver] = true (#191)
- isTxLimitExempt[buybackFeeReceiver] = true (#192)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in BabyDogeKingSon._transferFrom(address,address,uint256) (#234-257):
External calls:
- swapBack() (#245)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#302-308)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
External calls sending eth:
- swapBack() (#245)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#279)
- amountReceived = takeFee(sender,amount) (#252)
- Transfer(sender,recipient,amountReceived) (#255)
Reentrancy in BabyDogeKingSon.constructor() (#178-198):
External calls:
- pair = IDEXFactory(router.factory()).createPair(address(this),router.WETH()) (#180)
Event emitted after the call(s):
- Transfer(address(0),_owner,_liqSupply) (#196)
- Transfer(address(0),_DEAD,_burntSupply) (#197)
Reentrancy in BabyDogeKingSon.swapBack() (#291-332):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#302-308)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
External calls sending eth:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#322-329)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#330)
Apply the check-effects-interactions pattern.
Additional information: link
BabyDogeKingSon._transferFrom(address,address,uint256) (#234-257) uses timestamp for comparisons
Dangerous comparisons:
- ! launched() && recipient == pair (#247)
BabyDogeKingSon.launched() (#334-336) uses timestamp for comparisons
Dangerous comparisons:
- launchedAt != 0 (#335)
Avoid relying on block.timestamp.
Additional information: link
BabyDogeKingSon._liqSupply (#141) is set pre-construction with a non-constant function or state variable:
- (_totalSupply - _burntSupply)
BabyDogeKingSon.buyTotalFee (#149) is set pre-construction with a non-constant function or state variable:
- buyMarketingFee + buyBuyBackFee
BabyDogeKingSon.sellTotalFee (#154) is set pre-construction with a non-constant function or state variable:
- sellMarketingFee + sellBuyBackFee + sellLpFee
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.8.9 (#3) necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.7
solc-0.8.11 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in BabyDogeKingSon.swapBack() (#291-332):
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#316)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#318)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#63) is not in mixedCase
Parameter BabyDogeKingSon.setTargetLiquidity(uint256)._target (#359) is not in mixedCase
Parameter BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256)._liquidityFee (#374) is not in mixedCase
Parameter BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256)._buyMarketingFee (#374) is not in mixedCase
Parameter BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256)._buyBuybackFee (#374) is not in mixedCase
Parameter BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256)._sellMarketingFee (#374) is not in mixedCase
Parameter BabyDogeKingSon.setFees(uint256,uint256,uint256,uint56,uint256)._sellBuybackFee (#374) is not in mixedCase
Parameter BabyDogeKingSon.setFeeReceiver(address,address)._marketingFeeReceiver (#384) is not in mixedCase
Parameter BabyDogeKingSon.setFeeReceiver(address,address)._buybackFeeReceiver (#384) is not in mixedCase
Parameter BabyDogeKingSon.setSwapBackSettings(bool,uint256)._enabled (#390) is not in mixedCase
Parameter BabyDogeKingSon.setSwapBackSettings(bool,uint256)._amount (#390) is not in mixedCase
Function BabyDogeKingSon.ClearStuckBalance() (#399-403) is not in mixedCase
Parameter BabyDogeKingSon.transferForeignToken(address)._token (#405) is not in mixedCase
Variable BabyDogeKingSon._balances (#128) is not in mixedCase
Variable BabyDogeKingSon._allowances (#129) is not in mixedCase
Constant BabyDogeKingSon._name (#134) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BabyDogeKingSon._symbol (#135) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BabyDogeKingSon._decimals (#136) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BabyDogeKingSon._totalSupply (#139) is not in UPPER_CASE_WITH_UNDERSCORES
Variable BabyDogeKingSon._burntSupply (#140) is not in mixedCase
Variable BabyDogeKingSon._liqSupply (#141) is not in mixedCase
Variable BabyDogeKingSon._maxWalletSize (#144) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Reentrancy in BabyDogeKingSon.ClearStuckBalance() (#399-403):
External calls:
- address(marketingFeeReceiver).transfer(contractETHBalance) (#401)
Event emitted after the call(s):
- StuckBalanceSent(contractETHBalance,marketingFeeReceiver) (#402)
Reentrancy in BabyDogeKingSon.transferForeignToken(address) (#405-409):
External calls:
- address(marketingFeeReceiver).transfer(_contractBalance) (#407)
Event emitted after the call(s):
- ForeignTokenTransfer(_token,_contractBalance) (#408)
Apply the check-effects-interactions pattern.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#68) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#69)
Prevent variables from having similar names.
Additional information: link
BabyDogeKingSon.slitherConstructorConstantVariables() (#113-411) uses literals with too many digits:
- _totalSupply = 10000000 * (10 ** _decimals) (#139)
BabyDogeKingSon.slitherConstructorConstantVariables() (#113-411) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#161)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
Ownable._previousOwner (#30) is never used in BabyDogeKingSon (#113-411)
Remove unused state variables.
Additional information: link
BabyDogeKingSon._burntSupply (#140) should be constant
Ownable._previousOwner (#30) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#46-50)
transferForeignToken(address) should be declared external:
- BabyDogeKingSon.transferForeignToken(address) (#405-409)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Token is marked as scam (rug pull, honeypot, phishing, etc.)
Additional information: link
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts