Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
CATARM.swapBack() (#332-373) sends eth to arbitrary user
Dangerous calls:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in CATARM._transferFrom(address,address,uint256) (#273-293):
External calls:
- swapBack() (#282)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#343-349)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
External calls sending eth:
- swapBack() (#282)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#286)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#289)
- amountReceived = takeFee(sender,recipient,amount) (#288)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#319)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
CATARM.slitherConstructorVariables() (#188-457) performs a multiplication on the result of a division:
-swapThreshold = _totalSupply / 1000 * 3 (#224)
Consider ordering multiplication before division.
Additional information: link
CATARM.swapBack() (#332-373) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
Ensure that all the return values of the function calls are used.
Additional information: link
CATARM.setTxLimit(uint256) (#396-399) should emit an event for:
- _maxTxAmount = amount (#398)
CATARM.setFees(uint256,uint256,uint256,uint256) (#414-420) should emit an event for:
- liquidityFee = _liquidityFee (#415)
- buybackFee = _buybackFee (#416)
- marketingFee = _marketingFee (#417)
- totalFee = _liquidityFee.add(_buybackFee).add(_marketingFee) (#418)
- feeDenominator = _feeDenominator (#419)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#127) lacks a zero-check on :
- owner = adr (#128)
CATARM.setFeeReceiver(address,address)._marketingFeeReceiver (#422) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#423)
CATARM.setFeeReceiver(address,address)._buybackFeeReceiver (#422) lacks a zero-check on :
- buybackFeeReceiver = _buybackFeeReceiver (#424)
Check that the address is not zero.
Additional information: link
Reentrancy in CATARM._transferFrom(address,address,uint256) (#273-293):
External calls:
- swapBack() (#282)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#343-349)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
External calls sending eth:
- swapBack() (#282)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
State variables written after the call(s):
- launch() (#284)
- launchedAt = block.number (#393)
Reentrancy in CATARM.constructor() (#228-239):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#230)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#231)
- _balances[_owner] = _totalSupply (#237)
- isFeeExempt[_owner] = true (#234)
- isTxLimitExempt[_owner] = true (#235)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in CATARM._transferFrom(address,address,uint256) (#273-293):
External calls:
- swapBack() (#282)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#343-349)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
External calls sending eth:
- swapBack() (#282)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#320)
- amountReceived = takeFee(sender,recipient,amount) (#288)
- Transfer(sender,recipient,amountReceived) (#291)
Reentrancy in CATARM.constructor() (#228-239):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#230)
Event emitted after the call(s):
- Transfer(address(0),_owner,_totalSupply) (#238)
Reentrancy in CATARM.swapBack() (#332-373):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#343-349)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
External calls sending eth:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#363-370)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#371)
Apply the check-effects-interactions pattern.
Additional information: link
CATARM.buyTokens(uint256,address) (#375-386) is never used and should be removed
Remove unused functions.
Additional information: link
CATARM._maxTxAmount (#200) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 1) / 100
CATARM._maxWalletSize (#201) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 1) / 100
CATARM.swapThreshold (#224) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 1000 * 3
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in CATARM.swapBack() (#332-373):
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#357)
- (buybackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#359)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#142) is not in mixedCase
Parameter CATARM.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#414) is not in mixedCase
Parameter CATARM.setFees(uint256,uint256,uint256,uint256)._buybackFee (#414) is not in mixedCase
Parameter CATARM.setFees(uint256,uint256,uint256,uint256)._marketingFee (#414) is not in mixedCase
Parameter CATARM.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#414) is not in mixedCase
Parameter CATARM.setFeeReceiver(address,address)._marketingFeeReceiver (#422) is not in mixedCase
Parameter CATARM.setFeeReceiver(address,address)._buybackFeeReceiver (#422) is not in mixedCase
Parameter CATARM.setSwapBackSettings(bool,uint256)._enabled (#427) is not in mixedCase
Parameter CATARM.setSwapBackSettings(bool,uint256)._amount (#427) is not in mixedCase
Parameter CATARM.transferForeignToken(address)._token (#437) is not in mixedCase
Variable CATARM.WBNB (#191) is not in mixedCase
Variable CATARM.DEAD (#192) is not in mixedCase
Variable CATARM.ZERO (#193) is not in mixedCase
Constant CATARM._name (#195) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CATARM._symbol (#196) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CATARM._decimals (#197) is not in UPPER_CASE_WITH_UNDERSCORES
Variable CATARM._totalSupply (#199) is not in mixedCase
Variable CATARM._maxTxAmount (#200) is not in mixedCase
Variable CATARM._maxWalletSize (#201) is not in mixedCase
Variable CATARM._balances (#203) is not in mixedCase
Variable CATARM._allowances (#204) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#147) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#148)
Prevent variables from having similar names.
Additional information: link
CATARM.slitherConstructorVariables() (#188-457) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#192)
CATARM.slitherConstructorVariables() (#188-457) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#193)
CATARM.slitherConstructorVariables() (#188-457) uses literals with too many digits:
- _totalSupply = 1000000000 * (10 ** _decimals) (#199)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
CATARM.DEAD (#192) should be constant
CATARM.WBNB (#191) should be constant
CATARM.ZERO (#193) should be constant
CATARM._totalSupply (#199) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#99-101)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#106-108)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#127-131)
transferForeignToken(address) should be declared external:
- CATARM.transferForeignToken(address) (#437-441)
isOverLiquified(uint256,uint256) should be declared external:
- CATARM.isOverLiquified(uint256,uint256) (#451-453)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts