CatQueen Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

CatQueen.swapBack() (#589-633) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in CatQueen._transferFrom(address,address,uint256) (#495-540):
External calls:
- swapBack() (#519)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#600-606)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
External calls sending eth:
- swapBack() (#519)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#522)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#525)
- amountReceived = takeFee(sender,amount) (#524)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#560)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.distributeDividend(address) (#321-332) ignores return value by CATS.transfer(shareholder,amount) (#327)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

CatQueen.swapBack().tmpSuccess (#617) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
tmpSuccess = false (#620)
Fix or remove the writes.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#150) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#151)
Prevent variables from having similar names.

Additional information: link

CatQueen.slitherConstructorVariables() (#365-742) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#370)
CatQueen.slitherConstructorVariables() (#365-742) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#371)
CatQueen.slitherConstructorVariables() (#365-742) uses literals with too many digits:
- distributorGas = 500000 (#411)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

CatQueen.CATS (#368) is never used in CatQueen (#365-742)
Remove unused state variables.

Additional information: link

Reentrancy in DividendDistributor.distributeDividend(address) (#321-332):
External calls:
- CATS.transfer(shareholder,amount) (#327)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#329)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#330)
Reentrancy in DividendDistributor.process(uint256) (#290-314):
External calls:
- distributeDividend(shareholders[currentIndex]) (#306)
- CATS.transfer(shareholder,amount) (#327)
State variables written after the call(s):
- currentIndex ++ (#311)
Reentrancy in DividendDistributor.setShare(address,uint256) (#254-268):
External calls:
- distributeDividend(shareholder) (#256)
- CATS.transfer(shareholder,amount) (#327)
State variables written after the call(s):
- shares[shareholder].amount = amount (#266)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#267)
Apply the check-effects-interactions pattern.

Additional information: link

CatQueen.swapBack() (#589-633) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
Ensure that all the return values of the function calls are used.

Additional information: link

DividendDistributor.setDistributionCriteria(uint256,uint256) (#249-252) should emit an event for:
- minPeriod = _minPeriod (#250)
- minDistribution = _minDistribution (#251)
CatQueen.setTxLimit(uint256) (#635-637) should emit an event for:
- _maxTxAmount = amount (#636)
CatQueen.setFees(uint256,uint256,uint256,uint256) (#661-668) should emit an event for:
- liquidityFee = _liquidityFee (#662)
- reflectionFee = _reflectionFee (#663)
- marketingFee = _marketingFee (#664)
- totalFee = _liquidityFee.add(_reflectionFee).add(_marketingFee) (#665)
- feeDenominator = _feeDenominator (#666)
CatQueen.setTargetLiquidity(uint256,uint256) (#680-683) should emit an event for:
- targetLiquidity = _target (#681)
- targetLiquidityDenominator = _denominator (#682)
Emit an event for critical parameter changes.

Additional information: link

Auth.transferOwnership(address).adr (#130) lacks a zero-check on :
- owner = adr (#131)
CatQueen.setFeeReceivers(address,address)._autoLiquidityReceiver (#670) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#671)
CatQueen.setFeeReceivers(address,address)._marketingFeeReceiver (#670) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#672)
Check that the address is not zero.

Additional information: link

DividendDistributor.distributeDividend(address) (#321-332) has external calls inside a loop: CATS.transfer(shareholder,amount) (#327)
CatQueen.airdrop(address,address[],uint256[]) (#714-737) has external calls inside a loop: distributor.setShare(addresses[i_scope_0],_balances[addresses[i_scope_0]]) (#729)
Favor pull over push strategy for external calls.

Additional information: link

Reentrancy in CatQueen.constructor() (#423-454):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#425)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#426)
- _balances[msg.sender] = _totalSupply (#452)
- autoLiquidityReceiver = DEAD (#449)
- distributor = new DividendDistributor(address(router)) (#428)
- isDividendExempt[pair] = true (#444)
- isDividendExempt[address(this)] = true (#445)
- isDividendExempt[DEAD] = true (#446)
- isFeeExempt[msg.sender] = true (#430)
- isTimelockExempt[msg.sender] = true (#435)
- isTimelockExempt[DEAD] = true (#436)
- isTimelockExempt[address(this)] = true (#437)
- isTxLimitExempt[msg.sender] = true (#431)
- isTxLimitExempt[DEAD] = true (#432)
- marketingFeeReceiver = msg.sender (#450)
Reentrancy in DividendDistributor.deposit() (#270-288):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#277-282)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#287)
- totalDividends = totalDividends.add(amount) (#286)
Reentrancy in DividendDistributor.distributeDividend(address) (#321-332):
External calls:
- CATS.transfer(shareholder,amount) (#327)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#328)
Reentrancy in DividendDistributor.setShare(address,uint256) (#254-268):
External calls:
- distributeDividend(shareholder) (#256)
- CATS.transfer(shareholder,amount) (#327)
State variables written after the call(s):
- addShareholder(shareholder) (#260)
- shareholderIndexes[shareholder] = shareholders.length (#354)
- removeShareholder(shareholder) (#262)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#360)
- addShareholder(shareholder) (#260)
- shareholders.push(shareholder) (#355)
- removeShareholder(shareholder) (#262)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#359)
- shareholders.pop() (#361)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#265)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in CatQueen._transferFrom(address,address,uint256) (#495-540):
External calls:
- swapBack() (#519)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#600-606)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
- distributor.setShare(sender,_balances[sender]) (#529)
- distributor.setShare(recipient,_balances[recipient]) (#533)
- distributor.process(distributorGas) (#536)
External calls sending eth:
- swapBack() (#519)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#538)
Reentrancy in CatQueen._transferFrom(address,address,uint256) (#495-540):
External calls:
- swapBack() (#519)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#600-606)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
External calls sending eth:
- swapBack() (#519)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#561)
- amountReceived = takeFee(sender,amount) (#524)
Reentrancy in CatQueen.constructor() (#423-454):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#425)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#453)
Reentrancy in CatQueen.swapBack() (#589-633):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#600-606)
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#616)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#623-630)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#631)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.shouldDistribute(address) (#316-319) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#317-318)
CatQueen._transferFrom(address,address,uint256) (#495-540) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(cooldownTimer[recipient] < block.timestamp,Please wait for cooldown between buys) (#511)
Avoid relying on block.timestamp.

Additional information: link

DividendDistributor.process(uint256) (#290-314) has costly operations inside a loop:
- currentIndex = 0 (#302)
DividendDistributor.distributeDividend(address) (#321-332) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#326)
DividendDistributor.process(uint256) (#290-314) has costly operations inside a loop:
- currentIndex ++ (#311)
Use a local variable to hold the loop computation result.

Additional information: link

CatQueen._maxTxAmount (#378) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
CatQueen._maxWalletToken (#381) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 1) / 100
CatQueen.swapThreshold (#419) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 40 / 10000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version^0.7.4 (#14) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in CatQueen.swapBack() (#589-633):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#617)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IDEXRouter.WETH() (#145) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#249) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#249) is not in mixedCase
Variable DividendDistributor._token (#201) is not in mixedCase
Variable DividendDistributor.CATS (#209) is not in mixedCase
Variable DividendDistributor.WBNB (#210) is not in mixedCase
Parameter CatQueen.tradingStatus(bool)._status (#579) is not in mixedCase
Parameter CatQueen.cooldownEnabled(bool,uint8)._status (#584) is not in mixedCase
Parameter CatQueen.cooldownEnabled(bool,uint8)._interval (#584) is not in mixedCase
Parameter CatQueen.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#661) is not in mixedCase
Parameter CatQueen.setFees(uint256,uint256,uint256,uint256)._reflectionFee (#661) is not in mixedCase
Parameter CatQueen.setFees(uint256,uint256,uint256,uint256)._marketingFee (#661) is not in mixedCase
Parameter CatQueen.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#661) is not in mixedCase
Parameter CatQueen.setFeeReceivers(address,address)._autoLiquidityReceiver (#670) is not in mixedCase
Parameter CatQueen.setFeeReceivers(address,address)._marketingFeeReceiver (#670) is not in mixedCase
Parameter CatQueen.setSwapBackSettings(bool,uint256)._enabled (#675) is not in mixedCase
Parameter CatQueen.setSwapBackSettings(bool,uint256)._amount (#675) is not in mixedCase
Parameter CatQueen.setTargetLiquidity(uint256,uint256)._target (#680) is not in mixedCase
Parameter CatQueen.setTargetLiquidity(uint256,uint256)._denominator (#680) is not in mixedCase
Parameter CatQueen.setDistributionCriteria(uint256,uint256)._minPeriod (#691) is not in mixedCase
Parameter CatQueen.setDistributionCriteria(uint256,uint256)._minDistribution (#691) is not in mixedCase
Variable CatQueen.CATS (#368) is not in mixedCase
Variable CatQueen.WBNB (#369) is not in mixedCase
Variable CatQueen.DEAD (#370) is not in mixedCase
Variable CatQueen.ZERO (#371) is not in mixedCase
Constant CatQueen._name (#373) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CatQueen._symbol (#374) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CatQueen._decimals (#375) is not in UPPER_CASE_WITH_UNDERSCORES
Variable CatQueen._totalSupply (#377) is not in mixedCase
Variable CatQueen._maxTxAmount (#378) is not in mixedCase
Variable CatQueen._maxWalletToken (#381) is not in mixedCase
Variable CatQueen._balances (#383) is not in mixedCase
Variable CatQueen._allowances (#384) is not in mixedCase
Variable CatQueen._isBlacklisted (#390) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

CatQueen.CATS (#368) should be constant
CatQueen.DEAD (#370) should be constant
CatQueen.WBNB (#369) should be constant
CatQueen.ZERO (#371) should be constant
CatQueen._totalSupply (#377) should be constant
CatQueen.launchedAt (#407) should be constant
DividendDistributor.WBNB (#210) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#223) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

authorize(address) should be declared external:
- Auth.authorize(address) (#102-104)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#109-111)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#130-134)
tradingStatus(bool) should be declared external:
- CatQueen.tradingStatus(bool) (#579-581)
cooldownEnabled(bool,uint8) should be declared external:
- CatQueen.cooldownEnabled(bool,uint8) (#584-587)
Use the external attribute for functions never called from the contract.

Additional information: link