CATCOIN Token

Catcoin.rescueAnyBEP20Tokens(address,address,uint256) (#637-640) ignores return value by IERC20(_tokenAddr).transfer(_to,_amount) (#639)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Catcoin.addLiquidity(uint256,uint256) (#530-543) sends eth to arbitrary user
Dangerous calls:
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in Catcoin._transfer(address,address,uint256) (#449-485):
External calls:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- _rOwned[deadAddress] += rBurn (#382)
- _rOwned[marketingAddress] += rMarketing (#372)
- _rOwned[address(this)] += rLiquidity (#362)
- _rOwned[sender] = _rOwned[sender] - s.rAmount (#500)
- _rOwned[recipient] = _rOwned[recipient] + s.rTransferAmount (#501)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- _rTotal -= rRfi (#351)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- _tOwned[address(this)] += tLiquidity (#360)
- _tOwned[sender] = _tOwned[sender] - tAmount (#494)
- _tOwned[marketingAddress] += tMarketing (#370)
- _tOwned[deadAddress] += tBurn (#380)
- _tOwned[recipient] = _tOwned[recipient] + s.tTransferAmount (#497)
Apply the check-effects-interactions pattern.

Additional information: link

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Contract ownership is not renounced (belongs to a wallet)

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Parameter Catcoin.rescueAnyBEP20Tokens(address,address,uint256)._amount (#637) is not in mixedCase
Parameter Catcoin.updateSwapEnabled(bool)._enabled (#577) is not in mixedCase
Parameter Catcoin.setSellTaxes(uint256,uint256,uint256,uint256)._marketing (#341) is not in mixedCase
Parameter Catcoin.setSellTaxes(uint256,uint256,uint256,uint256)._rfi (#341) is not in mixedCase
Parameter Catcoin.setSellTaxes(uint256,uint256,uint256,uint256)._burn (#341) is not in mixedCase
Parameter Catcoin.setBuyTaxes(uint256,uint256,uint256,uint256)._liquidity (#332) is not in mixedCase
Parameter Catcoin.setTaxes(uint256,uint256,uint256,uint256)._rfi (#323) is not in mixedCase
Parameter Catcoin.rescueAnyBEP20Tokens(address,address,uint256)._to (#637) is not in mixedCase
Parameter Catcoin.updateAntiDump(uint256,uint256)._maxSellAmountPerCycle (#597) is not in mixedCase
Parameter Catcoin.setSellTaxes(uint256,uint256,uint256,uint256)._liquidity (#341) is not in mixedCase
Constant Catcoin.deadAddress (#134) is not in UPPER_CASE_WITH_UNDERSCORES
Constant Catcoin._name (#136) is not in UPPER_CASE_WITH_UNDERSCORES
Parameter Catcoin.setTaxes(uint256,uint256,uint256,uint256)._marketing (#323) is not in mixedCase
Parameter Catcoin.setTaxes(uint256,uint256,uint256,uint256)._liquidity (#323) is not in mixedCase
Parameter Catcoin.setBuyTaxes(uint256,uint256,uint256,uint256)._burn (#332) is not in mixedCase
Parameter Catcoin.rescueAnyBEP20Tokens(address,address,uint256)._tokenAddr (#637) is not in mixedCase
Parameter Catcoin.setTaxes(uint256,uint256,uint256,uint256)._burn (#323) is not in mixedCase
Function IRouter.WETH() (#78) is not in mixedCase
Constant Catcoin._symbol (#137) is not in UPPER_CASE_WITH_UNDERSCORES
Constant Catcoin._decimals (#114) is not in UPPER_CASE_WITH_UNDERSCORES
Struct Catcoin.valuesFromGetValues (#159-171) is not in CapWords
Parameter Catcoin.setBuyTaxes(uint256,uint256,uint256,uint256)._rfi (#332) is not in mixedCase
Parameter Catcoin.setBuyTaxes(uint256,uint256,uint256,uint256)._marketing (#332) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#33)" inContext (#27-36)
Remove redundant statements if they congest code but offer no value.

Additional information: link

Catcoin.slitherConstructorConstantVariables() (#96-645) uses literals with too many digits:
- deadAddress = 0x000000000000000000000000000000000000dEaD (#134)
Catcoin.slitherConstructorVariables() (#96-645) uses literals with too many digits:
- marketingAddress = 0x000000000000000000000000000000000000dEaD (#133)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

Catcoin._tTotal (#117) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.

Catcoin._transfer(address,address,uint256) (#449-485) uses timestamp for comparisons
Dangerous comparisons:
- newCycle = block.timestamp - userLastSell[from].lastSellTime >= antiDumpCycle (#462)
Avoid relying on block.timestamp.

Additional information: link

Catcoin._transfer(address,address,uint256).category (#479) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

Catcoin.addLiquidity(uint256,uint256) (#530-543) ignores return value by router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
Ensure that all the return values of the function calls are used.

Additional information: link

Catcoin._approve(address,address,uint256).owner (#442) shadows:
- Ownable.owner() (#47-49) (function)
Catcoin.allowance(address,address).owner (#227) shadows:
- Ownable.owner() (#47-49) (function)
Rename the local variables that shadow another component.

Additional information: link

Catcoin.updateSwapTokensAtAmount(uint256) (#573-575) should emit an event for:
- swapTokensAtAmount = amount * 10 ** _decimals (#574)
Catcoin.updateAntiDump(uint256,uint256) (#597-601) should emit an event for:
- antiDumpCycle = timeInMinutes * 60 (#599)
- maxSellAmountPerCycle = _maxSellAmountPerCycle * 10 ** _decimals (#600)
Catcoin.updateAntiWhaleAmt(uint256) (#569-571) should emit an event for:
- antiWhaleAmt = amount * 10 ** _decimals (#570)
Emit an event for critical parameter changes.

Additional information: link

Catcoin.constructor(address)._pair (#184-185) lacks a zero-check on :
- pair = _pair (#188)
Catcoin.updateRouterAndPair(address,address).newPair (#592) lacks a zero-check on :
- pair = newPair (#594)
Check that the address is not zero.

Additional information: link

Reentrancy in Catcoin._transfer(address,address,uint256) (#449-485):
External calls:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- totFeesPaid.marketing += tMarketing (#366)
- totFeesPaid.liquidity += tLiquidity (#356)
- totFeesPaid.burn += tBurn (#376)
- totFeesPaid.rfi += tRfi (#352)
Reentrancy in Catcoin.transferFrom(address,address,uint256) (#236-244):
External calls:
- _transfer(sender,recipient,amount) (#237)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
External calls sending eth:
- _transfer(sender,recipient,amount) (#237)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
State variables written after the call(s):
- _approve(sender,_msgSender(),currentAllowance - amount) (#241)
- _allowances[owner][spender] = amount (#445)
Reentrancy in Catcoin.swapAndLiquify(uint256) (#520-528):
External calls:
- swapTokensForBNB(tokensToSwap,address(this)) (#525)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
External calls sending eth:
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
State variables written after the call(s):
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
- _allowances[owner][spender] = amount (#445)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in Catcoin._transfer(address,address,uint256) (#449-485):
External calls:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount) (#476)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
Event emitted after the call(s):
- Transfer(sender,address(this),s.tLiquidity) (#506)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- Transfer(sender,marketingAddress,s.tMarketing) (#510)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- Transfer(sender,deadAddress,s.tBurn) (#514)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
- Transfer(sender,recipient,s.tTransferAmount) (#516)
- _tokenTransfer(from,to,amount,! (_isExcludedFromFee[from] || _isExcludedFromFee[to]),category) (#484)
Reentrancy in Catcoin.transferFrom(address,address,uint256) (#236-244):
External calls:
- _transfer(sender,recipient,amount) (#237)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
External calls sending eth:
- _transfer(sender,recipient,amount) (#237)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#446)
- _approve(sender,_msgSender(),currentAllowance - amount) (#241)
Reentrancy in Catcoin.swapAndLiquify(uint256) (#520-528):
External calls:
- swapTokensForBNB(tokensToSwap,address(this)) (#525)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(recipient),block.timestamp) (#554-560)
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
External calls sending eth:
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#535-542)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#446)
- addLiquidity(otherHalfOfTokens,newBalance) (#527)
Apply the check-effects-interactions pattern.

Additional information: link

Catcoin.includeInReward(address) (#296-307) has costly operations inside a loop:
- _excluded.pop() (#303)
Use a local variable to hold the loop computation result.

Additional information: link

Context._msgData() (#32-35) is never used and should be removed
Remove unused functions.

Additional information: link

Catcoin._rTotal (#118) is set pre-construction with a non-constant function or state variable:
- (MAX - (MAX % _tTotal))
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

reflectionFromToken(uint256,bool) should be declared external:
- Catcoin.reflectionFromToken(uint256,bool) (#263-272)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#56-58)
transfer(address,uint256) should be declared external:
- Catcoin.transfer(address,uint256) (#222-225)
approve(address,uint256) should be declared external:
- Catcoin.approve(address,uint256) (#231-234)
excludeFromFee(address) should be declared external:
- Catcoin.excludeFromFee(address) (#310-312)
rescueAnyBEP20Tokens(address,address,uint256) should be declared external:
- Catcoin.rescueAnyBEP20Tokens(address,address,uint256) (#637-640)
symbol() should be declared external:
- Catcoin.symbol() (#205-207)
isBot(address) should be declared external:
- Catcoin.isBot(address) (#603-605)
decimals() should be declared external:
- Catcoin.decimals() (#208-210)
isExcludedFromReward(address) should be declared external:
- Catcoin.isExcludedFromReward(address) (#259-261)
decreaseAllowance(address,uint256) should be declared external:
- Catcoin.decreaseAllowance(address,uint256) (#251-257)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#60-63)
name() should be declared external:
- Catcoin.name() (#202-204)
setBuyTaxes(uint256,uint256,uint256,uint256) should be declared external:
- Catcoin.setBuyTaxes(uint256,uint256,uint256,uint256) (#332-339)
allowance(address,address) should be declared external:
- Catcoin.allowance(address,address) (#227-229)
isExcludedFromFee(address) should be declared external:
- Catcoin.isExcludedFromFee(address) (#319-321)
transferFrom(address,address,uint256) should be declared external:
- Catcoin.transferFrom(address,address,uint256) (#236-244)
setSellTaxes(uint256,uint256,uint256,uint256) should be declared external:
- Catcoin.setSellTaxes(uint256,uint256,uint256,uint256) (#341-348)
totalSupply() should be declared external:
- Catcoin.totalSupply() (#213-215)
increaseAllowance(address,uint256) should be declared external:
- Catcoin.increaseAllowance(address,uint256) (#246-249)
setTaxes(uint256,uint256,uint256,uint256) should be declared external:
- Catcoin.setTaxes(uint256,uint256,uint256,uint256) (#323-330)
includeInFee(address) should be declared external:
- Catcoin.includeInFee(address) (#314-316)
Use the external attribute for functions never called from the contract.

Additional information: link

Attempt to swap token was unsuccessful. For some reason it is untradeable. If token is not in presale stage and is not traded outside PancakeSwap, then it's a scam

Additional information: link

Average 30d PancakeSwap liquidity is less than $100. Token is either dead or inactive.

Token has no transactions for more than 100 days. It seems dead / abandoned.

Average 30d number of PancakeSwap swaps is less than 1. Token is either dead or inactive.

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find token on CoinHunt

Additional information: link

Unable to find code repository for the project

Unable to verify token contract address on the website

Token is marked as scam (rug pull, honeypot, phishing, etc.)

Additional information: link

Young tokens have high risks of scam / price dump / death

Token has a considerable age, but social accounts / website are missing or have few users

Young tokens have high risks of price dump / death

Token has relatively low CoinGecko rank