CBF [Circle Base] Token

CircleBase.swapBack() (#814-854) sends eth to arbitrary user
Dangerous calls:
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in CircleBase._transferFrom(address,address,uint256) (#717-742):
External calls:
- rebase() (#723)
- pairContract.sync() (#677)
- addLiquidity() (#724)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#791-797)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
- swapBack() (#725)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#828-834)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
- (success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
External calls sending eth:
- addLiquidity() (#724)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
- swapBack() (#725)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
- (success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
State variables written after the call(s):
- _gonBalances[sender] = _gonBalances[sender].sub(gonAmount) (#728)
- _gonBalances[recipient] = _gonBalances[recipient].add(gonAmountReceived) (#732-734)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#729-731)
- _gonBalances[infernoReceiver] = _gonBalances[infernoReceiver].add(gonAmount.mul(infernoFee).div(feeDenominator)) (#759-761)
- _gonBalances[address(this)] = _gonBalances[address(this)].add(gonAmount.mul(_treasuryFee.add(cbfRiskFreeValueFee).add(bankFee)).div(feeDenominator)) (#763)
- _gonBalances[autoLiquidityReceiver] = _gonBalances[autoLiquidityReceiver].add(gonAmount.mul(liquidityFee).div(feeDenominator)) (#765)
- swapBack() (#725)
- inSwap = true (#591)
- inSwap = false (#593)
Apply the check-effects-interactions pattern.

Additional information: link

CircleBase._name (#545) shadows:
- ERC20Detailed._name (#469)
CircleBase._symbol (#546) shadows:
- ERC20Detailed._symbol (#470)
CircleBase._decimals (#547) shadows:
- ERC20Detailed._decimals (#471)
Remove the state variable shadowing.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

CircleBase.swapBack().success (#842) is written in both
(success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
(success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
CircleBase.swapBack().success (#842) is written in both
(success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
(success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
Fix or remove the writes.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Contract ownership is not renounced (belongs to a wallet)

CircleBase.rebase() (#646-680) performs a multiplication on the result of a division:
-times = deltaTime.div(5) (#651)
-epoch = times.mul(5) (#652)
CircleBase.rebase() (#646-680) performs a multiplication on the result of a division:
-times = deltaTime.div(5) (#651)
-_lastRebasedTime = _lastRebasedTime.add(times.mul(5)) (#675)
CircleBase.getLiquidityBacking(uint256) (#1006-1014) performs a multiplication on the result of a division:
-liquidityBalance = _gonBalances[pair].div(_gonsPerFragment) (#1011)
-accuracy.mul(liquidityBalance.mul(2)).div(getCirculatingSupply()) (#1012-1013)
Consider ordering multiplication before division.

Additional information: link

CircleBase.addLiquidity() (#771-812) ignores return value by router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
Ensure that all the return values of the function calls are used.

Additional information: link

CircleBase.setFeeReceivers(address,address,address)._autoLiquidityReceiver (#997) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#1001)
CircleBase.setFeeReceivers(address,address,address)._treasuryReceiver (#998) lacks a zero-check on :
- treasuryReceiver = _treasuryReceiver (#1002)
CircleBase.setFeeReceivers(address,address,address)._cbfRiskFreeValueReceiver (#999) lacks a zero-check on :
- cbfRiskFreeValueReceiver = _cbfRiskFreeValueReceiver (#1003)
CircleBase.setPairAddress(address)._pairAddress (#1020) lacks a zero-check on :
- pairAddress = _pairAddress (#1021)
Check that the address is not zero.

Additional information: link

Reentrancy in CircleBase.addLiquidity() (#771-812):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#791-797)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
External calls sending eth:
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
State variables written after the call(s):
- _lastAddLiquidityTime = block.timestamp (#811)
Reentrancy in CircleBase.constructor() (#612-644):
External calls:
- pair = IPancakeSwapFactory(router.factory()).createPair(router.WETH(),address(this)) (#617-620)
State variables written after the call(s):
- _allowedFragments[address(this)][address(router)] = uint256(- 1) (#628)
- _autoAddLiquidity = true (#638)
- _gonBalances[treasuryReceiver] = TOTAL_GONS (#633)
- _gonsPerFragment = TOTAL_GONS.div(_totalSupply) (#634)
- _initRebaseStartTime = block.timestamp (#635)
- _isFeeExempt[treasuryReceiver] = true (#639)
- _isFeeExempt[address(this)] = true (#640)
- _lastRebasedTime = block.timestamp (#636)
- _transferOwnership(treasuryReceiver) (#642)
- _owner = newOwner (#535)
- _totalSupply = INITIAL_FRAGMENTS_SUPPLY (#632)
- autoLiquidityReceiver = 0xAdBeA0Dd96b7ea2a370237A265cd9132AE8bBd62 (#622)
- bankReceiver = 0xE6eCd14cB5c4Fa198669EEE675b0Afb27c9eD1B9 (#625)
- cbfRiskFreeValueReceiver = 0x085be7f24eD1CFe8e044AeC9B53946572eCE2d3A (#624)
- infernoReceiver = 0x0000000000000000000000000000000000000000 (#626)
- pairAddress = pair (#629)
- pairContract = IPancakeSwapPair(pair) (#630)
- treasuryReceiver = 0x85d9Ff1DaF1C4c73508899ac4C8D165534a5318e (#623)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in CircleBase._transferFrom(address,address,uint256) (#717-742):
External calls:
- rebase() (#723)
- pairContract.sync() (#677)
- addLiquidity() (#724)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#791-797)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
- swapBack() (#725)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#828-834)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
- (success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
External calls sending eth:
- addLiquidity() (#724)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#802-809)
- swapBack() (#725)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
- (success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount.div(_gonsPerFragment)) (#767)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#729-731)
- Transfer(sender,recipient,gonAmountReceived.div(_gonsPerFragment)) (#736-740)
Reentrancy in CircleBase.constructor() (#612-644):
External calls:
- pair = IPancakeSwapFactory(router.factory()).createPair(router.WETH(),address(this)) (#617-620)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#534)
- _transferOwnership(treasuryReceiver) (#642)
- Transfer(address(0x0),treasuryReceiver,_totalSupply) (#643)
Reentrancy in CircleBase.rebase() (#646-680):
External calls:
- pairContract.sync() (#677)
Event emitted after the call(s):
- LogRebase(epoch,_totalSupply) (#679)
Apply the check-effects-interactions pattern.

Additional information: link

CircleBase.rebase() (#646-680) uses timestamp for comparisons
Dangerous comparisons:
- deltaTimeFromInit >= (8 * 31536000) (#654)
- deltaTimeFromInit >= (5 * 31536000) (#656)
- deltaTimeFromInit >= (3 * 31536000) (#658)
- deltaTimeFromInit >= (2 * 31536000) (#660)
- deltaTimeFromInit >= (31536000) (#662)
- i < times (#668)
CircleBase.shouldRebase() (#884-891) uses timestamp for comparisons
Dangerous comparisons:
- _autoRebase && (_totalSupply < MAX_SUPPLY) && msg.sender != pair && ! inSwap && block.timestamp >= (_lastRebasedTime + 5) (#885-890)
CircleBase.shouldAddLiquidity() (#893-899) uses timestamp for comparisons
Dangerous comparisons:
- _autoAddLiquidity && ! inSwap && msg.sender != pair && block.timestamp >= (_lastAddLiquidityTime + 86400) (#894-898)
Avoid relying on block.timestamp.

Additional information: link

SafeMath.mod(uint256,uint256) (#433-436) is never used and should be removed
SafeMathInt.abs(int256) (#378-381) is never used and should be removed
SafeMathInt.add(int256,int256) (#372-376) is never used and should be removed
SafeMathInt.div(int256,int256) (#360-364) is never used and should be removed
SafeMathInt.mul(int256,int256) (#352-358) is never used and should be removed
SafeMathInt.sub(int256,int256) (#366-370) is never used and should be removed
Remove unused functions.

Additional information: link

Pragma version^0.7.4 (#3) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in CircleBase.swapBack() (#814-854):
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(treasuryFee).div(_currentFee)}() (#842-845)
- (success,None) = address(cbfRiskFreeValueReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(cbfRiskFreeValueFee).div(_currentFee)}() (#846-849)
- (success,None) = address(bankReceiver).call{gas: 30000,value: amountETHToTreasuryAndRFV.mul(bankFee).div(_currentFee)}() (#850-853)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IPancakeSwapRouter.WETH() (#38) is not in mixedCase
Function IPancakeSwapPair.DOMAIN_SEPARATOR() (#272) is not in mixedCase
Function IPancakeSwapPair.PERMIT_TYPEHASH() (#274) is not in mixedCase
Function IPancakeSwapPair.MINIMUM_LIQUIDITY() (#305) is not in mixedCase
Parameter CircleBase.setAutoRebase(bool)._flag (#905) is not in mixedCase
Parameter CircleBase.setAutoAddLiquidity(bool)._flag (#914) is not in mixedCase
Parameter CircleBase.checkFeeExempt(address)._addr (#977) is not in mixedCase
Parameter CircleBase.setFeeReceivers(address,address,address)._autoLiquidityReceiver (#997) is not in mixedCase
Parameter CircleBase.setFeeReceivers(address,address,address)._treasuryReceiver (#998) is not in mixedCase
Parameter CircleBase.setFeeReceivers(address,address,address)._cbfRiskFreeValueReceiver (#999) is not in mixedCase
Parameter CircleBase.setWhitelist(address)._addr (#1016) is not in mixedCase
Parameter CircleBase.setPairAddress(address)._pairAddress (#1020) is not in mixedCase
Parameter CircleBase.setLP(address)._address (#1024) is not in mixedCase
Constant CircleBase._name (#545) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase._symbol (#546) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase._decimals (#547) is not in UPPER_CASE_WITH_UNDERSCORES
Variable CircleBase._isFeeExempt (#550) is not in mixedCase
Constant CircleBase.liquidityFee (#564) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.treasuryFee (#565) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.cbfRiskFreeValueFee (#566) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.infernoFee (#567) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.bankFee (#568) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.sellFee (#570) is not in UPPER_CASE_WITH_UNDERSCORES
Constant CircleBase.feeDenominator (#574) is not in UPPER_CASE_WITH_UNDERSCORES
Variable CircleBase._autoRebase (#601) is not in mixedCase
Variable CircleBase._autoAddLiquidity (#602) is not in mixedCase
Variable CircleBase._initRebaseStartTime (#603) is not in mixedCase
Variable CircleBase._lastRebasedTime (#604) is not in mixedCase
Variable CircleBase._lastAddLiquidityTime (#605) is not in mixedCase
Variable CircleBase._totalSupply (#606) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#43) is too similar to IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#44)
Prevent variables from having similar names.

Additional information: link

CircleBase.constructor() (#612-644) uses literals with too many digits:
- infernoReceiver = 0x0000000000000000000000000000000000000000 (#626)
CircleBase.slitherConstructorConstantVariables() (#539-1038) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#576)
CircleBase.slitherConstructorConstantVariables() (#539-1038) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#577)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

SafeMathInt.MAX_INT256 (#350) is never used in SafeMathInt (#348-382)
Remove unused state variables.

Additional information: link

CircleBase.totalFee (#572) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

name() should be declared external:
- ERC20Detailed.name() (#483-485)
symbol() should be declared external:
- ERC20Detailed.symbol() (#487-489)
decimals() should be declared external:
- ERC20Detailed.decimals() (#491-493)
owner() should be declared external:
- Ownable.owner() (#510-512)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#523-526)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#528-530)
Use the external attribute for functions never called from the contract.

Additional information: link

Token seems to be untradeable: there is no PancakeSwap trading pair and no trading volumes. Ignore for presale.

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find KYC or doxxing proof

Unable to find whitepaper link on the website

Unable to find token on CoinGecko

Additional information: link

Unable to find token on CoinMarketCap

Additional information: link

Token is not listed at Mobula.Finance

Additional information: link

Unable to find code repository for the project

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank

Token has no active CoinMarketCap listing / rank