CATBOY Token

CATBOY.swapBack() (#347-392) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

Reentrancy in CATBOY._transferFrom(address,address,uint256) (#267-298):
External calls:
- swapBack() (#288)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#358-364)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
External calls sending eth:
- swapBack() (#288)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#291)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#294)
- amountReceived = takeFee(sender,amount,recipient) (#293)
- _balances[address(this)] = _balances[address(this)].add(contractTokens) (#329)
- _balances[utilityFeeReceiver] = _balances[utilityFeeReceiver].add(utilityTokens) (#330)
Apply the check-effects-interactions pattern.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Contract ownership is not renounced (belongs to a wallet)

CATBOY.swapBack().tmpSuccess (#375) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
(tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
CATBOY.swapBack().tmpSuccess (#375) is written in both
(tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
(tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
CATBOY.swapBack().tmpSuccess (#375) is written in both
(tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
tmpSuccess = false (#379)
Fix or remove the writes.

Additional information: link

Low level call in CATBOY.swapBack() (#347-392):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Pragma version^0.8.9 (#3) necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.7
solc-0.8.9 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Function IDEXRouter.WETH() (#104) is not in mixedCase
Function CATBOY.setMaxWalletPercent_base1000(uint256) (#395-397) is not in mixedCase
Parameter CATBOY.setMaxWalletPercent_base1000(uint256).maxWallPercent_base1000 (#395) is not in mixedCase
Function CATBOY.setMaxTxPercent_base1000(uint256) (#398-400) is not in mixedCase
Parameter CATBOY.setMaxTxPercent_base1000(uint256).maxTXPercentage_base1000 (#398) is not in mixedCase
Parameter CATBOY.setMultipliers(uint256,uint256,uint256)._buy (#411) is not in mixedCase
Parameter CATBOY.setMultipliers(uint256,uint256,uint256)._sell (#411) is not in mixedCase
Parameter CATBOY.setMultipliers(uint256,uint256,uint256)._trans (#411) is not in mixedCase
Parameter CATBOY.tradingStatus(bool)._status (#417) is not in mixedCase
Function CATBOY.tradingStatus_antibot(bool) (#421-423) is not in mixedCase
Parameter CATBOY.tradingStatus_antibot(bool)._status (#421) is not in mixedCase
Function CATBOY.manage_blacklist_status(bool) (#425-427) is not in mixedCase
Parameter CATBOY.manage_blacklist_status(bool)._status (#425) is not in mixedCase
Function CATBOY.manage_blacklist(address[],bool) (#429-434) is not in mixedCase
Function CATBOY.manage_FeeExempt(address[],bool) (#436-441) is not in mixedCase
Function CATBOY.manage_TxLimitExempt(address[],bool) (#443-448) is not in mixedCase
Function CATBOY.manage_WalletLimitExempt(address[],bool) (#450-455) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._liquidityFee (#469) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._devFee (#469) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._marketingFee (#469) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._teamFee (#469) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._utilityFee (#469) is not in mixedCase
Parameter CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256)._feeDenominator (#469) is not in mixedCase
Parameter CATBOY.setFeeReceivers(address,address,address,address,address)._autoLiquidityReceiver (#480) is not in mixedCase
Parameter CATBOY.setFeeReceivers(address,address,address,address,address)._marketingFeeReceiver (#480) is not in mixedCase
Parameter CATBOY.setFeeReceivers(address,address,address,address,address)._teamFeeReceiver (#480) is not in mixedCase
Parameter CATBOY.setFeeReceivers(address,address,address,address,address)._utilityFeeReceiver (#480) is not in mixedCase
Parameter CATBOY.setFeeReceivers(address,address,address,address,address)._devFeeReceiver (#480) is not in mixedCase
Parameter CATBOY.setSwapBackSettings(bool,uint256)._enabled (#488) is not in mixedCase
Parameter CATBOY.setSwapBackSettings(bool,uint256)._amount (#488) is not in mixedCase
Parameter CATBOY.setTargetLiquidity(uint256,uint256)._target (#493) is not in mixedCase
Parameter CATBOY.setTargetLiquidity(uint256,uint256)._denominator (#493) is not in mixedCase
Variable CATBOY.WBNB (#153) is not in mixedCase
Variable CATBOY.DEAD (#154) is not in mixedCase
Variable CATBOY.ZERO (#155) is not in mixedCase
Constant CATBOY._name (#157) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CATBOY._symbol (#158) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CATBOY._decimals (#159) is not in UPPER_CASE_WITH_UNDERSCORES
Variable CATBOY._totalSupply (#161) is not in mixedCase
Variable CATBOY._maxTxAmount (#163) is not in mixedCase
Variable CATBOY._maxWalletToken (#164) is not in mixedCase
Variable CATBOY._balances (#166) is not in mixedCase
Variable CATBOY._allowances (#167) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#109) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#110)
Prevent variables from having similar names.

Additional information: link

CATBOY.slitherConstructorVariables() (#150-531) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#154)
CATBOY.slitherConstructorVariables() (#150-531) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#155)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

CATBOY.DEAD (#154) should be constant
CATBOY.WBNB (#153) should be constant
CATBOY.ZERO (#155) should be constant
CATBOY._totalSupply (#161) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

authorize(address) should be declared external:
- Auth.authorize(address) (#73-75)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#77-79)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#89-93)
Use the external attribute for functions never called from the contract.

Additional information: link

CATBOY.takeFee(address,uint256,address) (#315-338) performs a multiplication on the result of a division:
-feeAmount = amount.mul(totalFee).mul(multiplier).div(feeDenominator * 100) (#324)
-utilityTokens = feeAmount.mul(utilityFee).div(totalFee) (#326)
Consider ordering multiplication before division.

Additional information: link

CATBOY.manage_TxLimitExempt(address[],bool).i (#445) is a local variable never initialized
CATBOY.manage_WalletLimitExempt(address[],bool).i (#452) is a local variable never initialized
CATBOY.manage_blacklist(address[],bool).i (#431) is a local variable never initialized
CATBOY.manage_FeeExempt(address[],bool).i (#438) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

CATBOY.swapBack() (#347-392) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
Ensure that all the return values of the function calls are used.

Additional information: link

CATBOY.setMaxTxPercent_base1000(uint256) (#398-400) should emit an event for:
- _maxTxAmount = (_totalSupply * maxTXPercentage_base1000) / 1000 (#399)
CATBOY.setMaxTxAbsolute(uint256) (#402-404) should emit an event for:
- _maxTxAmount = amount (#403)
CATBOY.setMultipliers(uint256,uint256,uint256) (#411-415) should emit an event for:
- sellMultiplier = _sell (#412)
- buyMultiplier = _buy (#413)
- transferMultiplier = _trans (#414)
CATBOY.setFees(uint256,uint256,uint256,uint256,uint256,uint256) (#469-478) should emit an event for:
- liquidityFee = _liquidityFee (#470)
- devFee = _devFee (#471)
- marketingFee = _marketingFee (#472)
- teamFee = _teamFee (#473)
- utilityFee = _utilityFee (#474)
- totalFee = _liquidityFee.add(_devFee).add(_marketingFee).add(_teamFee).add(_utilityFee) (#475)
- feeDenominator = _feeDenominator (#476)
CATBOY.setSwapBackSettings(bool,uint256) (#488-491) should emit an event for:
- swapThreshold = _amount (#490)
CATBOY.setTargetLiquidity(uint256,uint256) (#493-496) should emit an event for:
- targetLiquidity = _target (#494)
- targetLiquidityDenominator = _denominator (#495)
Emit an event for critical parameter changes.

Additional information: link

Auth.transferOwnership(address).adr (#89) lacks a zero-check on :
- owner = adr (#90)
CATBOY.setFeeReceivers(address,address,address,address,address)._autoLiquidityReceiver (#480) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#481)
CATBOY.setFeeReceivers(address,address,address,address,address)._marketingFeeReceiver (#480) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#482)
CATBOY.setFeeReceivers(address,address,address,address,address)._teamFeeReceiver (#480) lacks a zero-check on :
- teamFeeReceiver = _teamFeeReceiver (#483)
CATBOY.setFeeReceivers(address,address,address,address,address)._utilityFeeReceiver (#480) lacks a zero-check on :
- utilityFeeReceiver = _utilityFeeReceiver (#484)
CATBOY.setFeeReceivers(address,address,address,address,address)._devFeeReceiver (#480) lacks a zero-check on :
- devFeeReceiver = _devFeeReceiver (#485)
Check that the address is not zero.

Additional information: link

Reentrancy in CATBOY.constructor() (#208-233):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#210)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#212)
- _balances[msg.sender] = _totalSupply (#231)
- autoLiquidityReceiver = 0x7586c137FBae76a592b9e798979217414C53DBf3 (#214)
- devFeeReceiver = 0x277BdadF7A82Ab1a9C5Cac664abfdF748aFF3486 (#217)
- isFeeExempt[msg.sender] = true (#220)
- isTxLimitExempt[msg.sender] = true (#222)
- isTxLimitExempt[DEAD] = true (#223)
- isTxLimitExempt[ZERO] = true (#224)
- isWalletLimitExempt[msg.sender] = true (#226)
- isWalletLimitExempt[address(this)] = true (#227)
- isWalletLimitExempt[DEAD] = true (#228)
- isWalletLimitExempt[utilityFeeReceiver] = true (#229)
- marketingFeeReceiver = 0x4e6C011101a1087aC8c174D75C28ac28a2b72Fa2 (#215)
- teamFeeReceiver = 0x6090B09A46D72D53f0506d20C2E53D0Be820cD9d (#216)
- utilityFeeReceiver = 0x7465A00833F3E8BB6a545ba122baCe2a009d106f (#218)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in CATBOY._transferFrom(address,address,uint256) (#267-298):
External calls:
- swapBack() (#288)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#358-364)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
External calls sending eth:
- swapBack() (#288)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
Event emitted after the call(s):
- Transfer(sender,address(this),contractTokens) (#331)
- amountReceived = takeFee(sender,amount,recipient) (#293)
- Transfer(sender,utilityFeeReceiver,utilityTokens) (#334)
- amountReceived = takeFee(sender,amount,recipient) (#293)
- Transfer(sender,recipient,amountReceived) (#296)
Reentrancy in CATBOY.constructor() (#208-233):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#210)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#232)
Reentrancy in CATBOY.swapBack() (#347-392):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#358-364)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
External calls sending eth:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#375)
- (tmpSuccess,None) = address(teamFeeReceiver).call{gas: 30000,value: amountBNBteam}() (#376)
- (tmpSuccess,None) = address(devFeeReceiver).call{gas: 30000,value: amountBNBdevFee}() (#377)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#382-389)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#390)
Apply the check-effects-interactions pattern.

Additional information: link

CATBOY._maxTxAmount (#163) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 100
CATBOY._maxWalletToken (#164) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 50
CATBOY.totalFee (#181) is set pre-construction with a non-constant function or state variable:
- devFee + marketingFee + liquidityFee + teamFee + utilityFee
CATBOY.swapThreshold (#204) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 1000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Contract has 4% buy tax and 4% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Token is deployed only at one blockchain

Token has only one trading pair

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find KYC or doxxing proof

Unable to find token contract audit

Unable to find audit link on the website

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Token has relatively low CoinGecko rank

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death