ElonHype Token

ElonHype.swapBack() (#635-684) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

Reentrancy in ElonHype._transferFrom(address,address,uint256) (#570-611):
External calls:
- swapBack() (#580)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#645-651)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
External calls sending eth:
- swapBack() (#580)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#588)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#596)
- finalAmount = takeFee(sender,recipient,amount) (#595)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#625)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.distributeDividend(address) (#254-266) ignores return value by RewardToken.transfer(shareholder,amount) (#260)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

ElonHype.swapBack().tmpSuccess (#666) is written in both
(tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
tmpSuccess = false (#670)
ElonHype.swapBack().tmpSuccess1 (#667) is written in both
(tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
tmpSuccess1 = false (#671)
Fix or remove the writes.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Pragma version^0.7.4 (#23) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Reentrancy in DividendDistributor.distributeDividend(address) (#254-266):
External calls:
- RewardToken.transfer(shareholder,amount) (#260)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#262)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#263)
Reentrancy in DividendDistributor.process(uint256) (#225-247):
External calls:
- distributeDividend(shareholders[currentIndex]) (#239)
- RewardToken.transfer(shareholder,amount) (#260)
State variables written after the call(s):
- currentIndex ++ (#244)
Reentrancy in DividendDistributor.setShare(address,uint256) (#188-203):
External calls:
- distributeDividend(shareholder) (#191)
- RewardToken.transfer(shareholder,amount) (#260)
State variables written after the call(s):
- shares[shareholder].amount = amount (#201)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#202)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in ElonHype._transferFrom(address,address,uint256) (#570-611):
External calls:
- swapBack() (#580)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#645-651)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
External calls sending eth:
- swapBack() (#580)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
State variables written after the call(s):
- launch() (#584)
- launchedAt = block.number (#492)
Reentrancy in ElonHype.constructor() (#421-454):
External calls:
- pair = IDEXFactory(router.factory()).createPair(router.WETH(),address(this)) (#424)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#425)
- _balances[msg.sender] = _totalSupply (#452)
- anothermarketingWallet = 0xCe8b4E3155De0bDE4024723fa0116BD899173e98 (#446)
- autoLiquidityReceiver = msg.sender (#444)
- dividendDistributor = new DividendDistributor(address(router)) (#427)
- isDividendExempt[pair] = true (#437)
- isDividendExempt[address(this)] = true (#439)
- isDividendExempt[DEAD] = true (#440)
- isDividendExempt[ZERO] = true (#441)
- isFeeExempt[msg.sender] = true (#429)
- isFeeExempt[address(this)] = true (#430)
- isFeeExempt[anothermarketingWallet] = true (#431)
- isTxLimitExempt[msg.sender] = true (#433)
- isTxLimitExempt[pair] = true (#434)
- isTxLimitExempt[DEAD] = true (#435)
- marketingWallet = msg.sender (#445)
- totalFee = liquidityFee.add(marketingFee).add(rewardsFee) (#448)
- totalFeeIfSelling = totalFee.add(extraFeeOnSell) (#449)
Reentrancy in DividendDistributor.deposit() (#205-223):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#213-218)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#222)
- totalDividends = totalDividends.add(amount) (#221)
Reentrancy in DividendDistributor.distributeDividend(address) (#254-266):
External calls:
- RewardToken.transfer(shareholder,amount) (#260)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#261)
Reentrancy in DividendDistributor.setShare(address,uint256) (#188-203):
External calls:
- distributeDividend(shareholder) (#191)
- RewardToken.transfer(shareholder,amount) (#260)
State variables written after the call(s):
- addShareholder(shareholder) (#195)
- shareholderIndexes[shareholder] = shareholders.length (#284)
- removeShareholder(shareholder) (#197)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#290)
- addShareholder(shareholder) (#195)
- shareholders.push(shareholder) (#285)
- removeShareholder(shareholder) (#197)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#289)
- shareholders.pop() (#291)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#200)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in ElonHype._transferFrom(address,address,uint256) (#570-611):
External calls:
- swapBack() (#580)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#645-651)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
- dividendDistributor.setShare(sender,_balances[sender]) (#600)
- dividendDistributor.setShare(recipient,_balances[recipient]) (#604)
- dividendDistributor.process(distributorGas) (#607)
External calls sending eth:
- swapBack() (#580)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
Event emitted after the call(s):
- Transfer(sender,recipient,finalAmount) (#609)
Reentrancy in ElonHype._transferFrom(address,address,uint256) (#570-611):
External calls:
- swapBack() (#580)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#645-651)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
External calls sending eth:
- swapBack() (#580)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#626)
- finalAmount = takeFee(sender,recipient,amount) (#595)
Reentrancy in ElonHype.constructor() (#421-454):
External calls:
- pair = IDEXFactory(router.factory()).createPair(router.WETH(),address(this)) (#424)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#453)
Reentrancy in ElonHype.swapBack() (#635-684):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#645-651)
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
External calls sending eth:
- dividendDistributor.deposit{value: amountBNBReflection}() (#661)
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#682)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.shouldDistribute(address) (#249-252) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#250-251)
Avoid relying on block.timestamp.

Additional information: link

DividendDistributor.process(uint256) (#225-247) has costly operations inside a loop:
- currentIndex = 0 (#236)
DividendDistributor.distributeDividend(address) (#254-266) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#259)
DividendDistributor.process(uint256) (#225-247) has costly operations inside a loop:
- currentIndex ++ (#244)
Use a local variable to hold the loop computation result.

Additional information: link

ElonHype._maxTxAmount (#376) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 2 / 100
ElonHype._walletMax (#377) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 3 / 100
ElonHype.swapThreshold (#413) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 5 / 2000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Low level call in ElonHype.swapBack() (#635-684):
- (tmpSuccess) = address(marketingWallet).call{gas: 30000,value: marketingShare}() (#666)
- (tmpSuccess1) = address(anothermarketingWallet).call{gas: 30000,value: anothermarketingShare}() (#667)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IDEXRouter.WETH() (#82) is not in mixedCase
Variable DividendDistributor._token (#139) is not in mixedCase
Variable DividendDistributor.RewardToken (#149) is not in mixedCase
Constant ElonHype._name (#366) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ElonHype._symbol (#367) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ElonHype._decimals (#368) is not in UPPER_CASE_WITH_UNDERSCORES
Variable ElonHype.DEAD (#370) is not in mixedCase
Variable ElonHype.ZERO (#371) is not in mixedCase
Variable ElonHype.RewardToken (#373) is not in mixedCase
Variable ElonHype._totalSupply (#375) is not in mixedCase
Variable ElonHype._maxTxAmount (#376) is not in mixedCase
Variable ElonHype._walletMax (#377) is not in mixedCase
Variable ElonHype._balances (#381) is not in mixedCase
Variable ElonHype._allowances (#382) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#87) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#88)
Prevent variables from having similar names.

Additional information: link

ElonHype.slitherConstructorVariables() (#362-689) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#370)
ElonHype.slitherConstructorVariables() (#362-689) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#371)
ElonHype.slitherConstructorVariables() (#362-689) uses literals with too many digits:
- _totalSupply = 1000000000 * (10 ** _decimals) (#375)
ElonHype.slitherConstructorVariables() (#362-689) uses literals with too many digits:
- distributorGas = 300000 (#407)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

DividendDistributor.dividendsPerShareAccuracyFactor (#160) should be constant
DividendDistributor.routerAddress (#148) should be constant
ElonHype.DEAD (#370) should be constant
ElonHype.RewardToken (#373) should be constant
ElonHype.ZERO (#371) should be constant
ElonHype._totalSupply (#375) should be constant
ElonHype.routerAddress (#372) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

authorize(address) should be declared external:
- Auth.authorize(address) (#325-327)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#332-334)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#353-357)
getCirculatingSupply() should be declared external:
- ElonHype.getCirculatingSupply() (#464-466)
claim() should be declared external:
- ElonHype.claim() (#482-485)
tradingStatus(bool) should be declared external:
- ElonHype.tradingStatus(bool) (#631-633)
Use the external attribute for functions never called from the contract.

Additional information: link

DividendDistributor.setDistributionCriteria(uint256,uint256) (#183-186) should emit an event for:
- minPeriod = newMinPeriod (#184)
- minDistribution = newMinDistribution (#185)
ElonHype.changeFees(uint256,uint256,uint256,uint256) (#526-535) should emit an event for:
- liquidityFee = newLiqFee (#527)
- rewardsFee = newRewardFee (#528)
- totalFee = liquidityFee.add(marketingFee).add(rewardsFee) (#532)
- totalFeeIfSelling = totalFee.add(extraFeeOnSell) (#533)
Emit an event for critical parameter changes.

Additional information: link

Auth.transferOwnership(address).adr (#353) lacks a zero-check on :
- owner = adr (#354)
ElonHype.changeFeeReceivers(address,address,address).newLiquidityReceiver (#537) lacks a zero-check on :
- autoLiquidityReceiver = newLiquidityReceiver (#538)
ElonHype.changeFeeReceivers(address,address,address).newMarketingWallet (#537) lacks a zero-check on :
- marketingWallet = newMarketingWallet (#539)
ElonHype.changeFeeReceivers(address,address,address).newanothermarketingWallet (#537) lacks a zero-check on :
- anothermarketingWallet = newanothermarketingWallet (#540)
Check that the address is not zero.

Additional information: link

DividendDistributor.distributeDividend(address) (#254-266) has external calls inside a loop: RewardToken.transfer(shareholder,amount) (#260)
Favor pull over push strategy for external calls.

Additional information: link

ElonHype.swapBack() (#635-684) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#674-681)
Ensure that all the return values of the function calls are used.

Additional information: link

ElonHype.RewardToken (#373) is never used in ElonHype (#362-689)
Remove unused state variables.

Additional information: link

Contract has 1% buy tax and 81% sell tax.
Taxes are extremely high (over 30%)

Additional information: link

Token is deployed only at one blockchain

Average 30d PancakeSwap liquidity is low.

Token has only one trading pair

Token is not listed at Mobula.Finance

Additional information: link

Token is marked as scam (rug pull, honeypot, phishing, etc.)

Additional information: link

Young tokens have high risks of price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Token has relatively low CoinGecko rank