💙18💙
⏱ cosplayer ⏱
🥀twitch.tv/bonniebonkers🥀
🦴any pronouns🦴
Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
BONBI.swapBack() (#698-744) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in BONBI._transferFrom(address,address,uint256) (#639-678):
External calls:
- swapBack() (#646)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#708-714)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
External calls sending eth:
- swapBack() (#646)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#655)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#663)
- finalAmount = takeFee(sender,recipient,amount) (#662)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#692)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#318-330) ignores return value by RewardToken.transfer(shareholder,amount) (#324)
DividendDistributor.rescueDividends(address) (#336-338) ignores return value by RewardToken.transfer(to,RewardToken.balanceOf(address(this))) (#337)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.
BONBI.swapBack().tmpSuccess (#727) is written in both
(tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
tmpSuccess = false (#731)
Fix or remove the writes.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
BONBI.swapBack() (#698-744) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
Ensure that all the return values of the function calls are used.
Additional information: link
Reentrancy in DividendDistributor.distributeDividend(address) (#318-330):
External calls:
- RewardToken.transfer(shareholder,amount) (#324)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#326)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#327)
Reentrancy in DividendDistributor.process(uint256) (#289-311):
External calls:
- distributeDividend(shareholders[currentIndex]) (#303)
- RewardToken.transfer(shareholder,amount) (#324)
State variables written after the call(s):
- currentIndex ++ (#308)
Reentrancy in DividendDistributor.setShare(address,uint256) (#252-267):
External calls:
- distributeDividend(shareholder) (#255)
- RewardToken.transfer(shareholder,amount) (#324)
State variables written after the call(s):
- shares[shareholder].amount = amount (#265)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#266)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#247-250) should emit an event for:
- minPeriod = newMinPeriod (#248)
- minDistribution = newMinDistribution (#249)
BONBI.changeTxLimit(uint256) (#562-564) should emit an event for:
- _maxTxAmount = newLimit (#563)
BONBI.changeFees(uint256,uint256,uint256) (#593-600) should emit an event for:
- liquidityFee = newLiqFee (#594)
- rewardsFee = newRewardFee (#595)
- marketingFee = newMarketingFee (#596)
- totalFee = liquidityFee.add(marketingFee).add(rewardsFee) (#598)
- totalFeeIfSelling = totalFee (#599)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#426) lacks a zero-check on :
- owner = adr (#427)
BONBI.changeFeeReceivers(address,address).newLiquidityReceiver (#602) lacks a zero-check on :
- autoLiquidityReceiver = newLiquidityReceiver (#603)
BONBI.changeFeeReceivers(address,address).newMarketingWallet (#602) lacks a zero-check on :
- marketingWallet = newMarketingWallet (#604)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#318-330) has external calls inside a loop: RewardToken.transfer(shareholder,amount) (#324)
Favor pull over push strategy for external calls.
Additional information: link
Reentrancy in BONBI._transferFrom(address,address,uint256) (#639-678):
External calls:
- swapBack() (#646)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#708-714)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
External calls sending eth:
- swapBack() (#646)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
State variables written after the call(s):
- launch() (#650)
- launchedAt = block.number (#559)
Reentrancy in BONBI.constructor() (#493-523):
External calls:
- pair = IDEXFactory(router.factory()).createPair(router.WETH(),address(this)) (#496)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#497)
- _balances[msg.sender] = _totalSupply (#521)
- autoLiquidityReceiver = 0x05BcDfb9a93C2e588d8b473819f25650d2e11A9c (#514)
- dividendDistributor = new DividendDistributor(address(router)) (#499)
- isDividendExempt[pair] = true (#507)
- isDividendExempt[msg.sender] = true (#508)
- isDividendExempt[address(this)] = true (#509)
- isDividendExempt[DEAD] = true (#510)
- isDividendExempt[ZERO] = true (#511)
- isFeeExempt[msg.sender] = true (#501)
- isFeeExempt[address(this)] = true (#502)
- isTxLimitExempt[msg.sender] = true (#504)
- isTxLimitExempt[pair] = true (#505)
- marketingWallet = 0x05BcDfb9a93C2e588d8b473819f25650d2e11A9c (#515)
- totalFee = liquidityFee.add(marketingFee).add(rewardsFee) (#518)
- totalFeeIfSelling = totalFee (#519)
Reentrancy in DividendDistributor.deposit() (#269-287):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#277-282)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#286)
- totalDividends = totalDividends.add(amount) (#285)
Reentrancy in DividendDistributor.distributeDividend(address) (#318-330):
External calls:
- RewardToken.transfer(shareholder,amount) (#324)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#325)
Reentrancy in DividendDistributor.setShare(address,uint256) (#252-267):
External calls:
- distributeDividend(shareholder) (#255)
- RewardToken.transfer(shareholder,amount) (#324)
State variables written after the call(s):
- addShareholder(shareholder) (#259)
- shareholderIndexes[shareholder] = shareholders.length (#360)
- removeShareholder(shareholder) (#261)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#366)
- addShareholder(shareholder) (#259)
- shareholders.push(shareholder) (#361)
- removeShareholder(shareholder) (#261)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#365)
- shareholders.pop() (#367)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#264)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in BONBI._transferFrom(address,address,uint256) (#639-678):
External calls:
- swapBack() (#646)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#708-714)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
- dividendDistributor.setShare(sender,_balances[sender]) (#667)
- dividendDistributor.setShare(recipient,_balances[recipient]) (#671)
- dividendDistributor.process(distributorGas) (#674)
External calls sending eth:
- swapBack() (#646)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
Event emitted after the call(s):
- Transfer(sender,recipient,finalAmount) (#676)
Reentrancy in BONBI._transferFrom(address,address,uint256) (#639-678):
External calls:
- swapBack() (#646)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#708-714)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
External calls sending eth:
- swapBack() (#646)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#693)
- finalAmount = takeFee(sender,recipient,amount) (#662)
Reentrancy in BONBI.constructor() (#493-523):
External calls:
- pair = IDEXFactory(router.factory()).createPair(router.WETH(),address(this)) (#496)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#522)
Reentrancy in BONBI.swapBack() (#698-744):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#708-714)
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
External calls sending eth:
- dividendDistributor.deposit{value: amountBNBReflection}() (#725)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#734-741)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#742)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#313-316) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#314-315)
Avoid relying on block.timestamp.
Additional information: link
DividendDistributor.process(uint256) (#289-311) has costly operations inside a loop:
- currentIndex = 0 (#300)
DividendDistributor.distributeDividend(address) (#318-330) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#323)
DividendDistributor.process(uint256) (#289-311) has costly operations inside a loop:
- currentIndex ++ (#308)
Use a local variable to hold the loop computation result.
Additional information: link
BONBI.checkTxLimit(address,uint256) (#566-568) is never used and should be removed
Remove unused functions.
Additional information: link
BONBI._maxTxAmount (#449) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 30 / 1000
BONBI._walletMax (#450) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 30 / 1000
BONBI.swapThreshold (#485) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 5 / 2000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.7.4 (#87) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in BONBI.swapBack() (#698-744):
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: amountBNBMarketing}() (#727)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#147) is not in mixedCase
Parameter DividendDistributor.setRewardToken(address)._rewardToken (#340) is not in mixedCase
Variable DividendDistributor._token (#203) is not in mixedCase
Variable DividendDistributor.RewardToken (#213) is not in mixedCase
Parameter BONBI.setRewardToken(address)._rewardToken (#623) is not in mixedCase
Constant BONBI._name (#439) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BONBI._symbol (#440) is not in UPPER_CASE_WITH_UNDERSCORES
Constant BONBI._decimals (#441) is not in UPPER_CASE_WITH_UNDERSCORES
Variable BONBI.DEAD (#443) is not in mixedCase
Variable BONBI.ZERO (#444) is not in mixedCase
Variable BONBI.RewardToken (#446) is not in mixedCase
Variable BONBI._totalSupply (#448) is not in mixedCase
Variable BONBI._maxTxAmount (#449) is not in mixedCase
Variable BONBI._walletMax (#450) is not in mixedCase
Variable BONBI._balances (#453) is not in mixedCase
Variable BONBI._allowances (#454) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#152) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#153)
Prevent variables from having similar names.
Additional information: link
BONBI.slitherConstructorVariables() (#435-749) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#443)
BONBI.slitherConstructorVariables() (#435-749) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#444)
BONBI.slitherConstructorVariables() (#435-749) uses literals with too many digits:
- _totalSupply = 1000000000 * (10 ** _decimals) (#448)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
BONBI.RewardToken (#446) is never used in BONBI (#435-749)
Remove unused state variables.
Additional information: link
BONBI.DEAD (#443) should be constant
BONBI.RewardToken (#446) should be constant
BONBI.ZERO (#444) should be constant
BONBI._totalSupply (#448) should be constant
BONBI.restrictWhales (#451) should be constant
BONBI.routerAddress (#445) should be constant
BONBI.tradingOpen (#476) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#224) should be constant
DividendDistributor.routerAddress (#212) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#398-400)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#405-407)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#426-430)
getCirculatingSupply() should be declared external:
- BONBI.getCirculatingSupply() (#533-535)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Twitter account
Telegram account has relatively few subscribers
Unable to find Blog account (Reddit or Medium)
Unable to find Youtube account
Unable to find Discord account