Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
ExistFinance.swapBack() (#623-662) sends eth to arbitrary user
Dangerous calls:
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in ExistFinance._transferFrom(address,address,uint256) (#507-555):
External calls:
- swapBack() (#535)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#634-640)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
External calls sending eth:
- swapBack() (#535)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#538)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#540)
- amountReceived = takeFee(sender,recipient,amount) (#539)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#599)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#326-337) ignores return value by BETH.transfer(shareholder,amount) (#332)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Low level call in ExistFinance.swapBack() (#623-662):
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Reentrancy in DividendDistributor.distributeDividend(address) (#326-337):
External calls:
- BETH.transfer(shareholder,amount) (#332)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#334)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#335)
Reentrancy in DividendDistributor.process(uint256) (#295-319):
External calls:
- distributeDividend(shareholders[currentIndex]) (#311)
- BETH.transfer(shareholder,amount) (#332)
State variables written after the call(s):
- currentIndex ++ (#316)
Reentrancy in DividendDistributor.setShare(address,uint256) (#259-273):
External calls:
- distributeDividend(shareholder) (#261)
- BETH.transfer(shareholder,amount) (#332)
State variables written after the call(s):
- shares[shareholder].amount = amount (#271)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#272)
Apply the check-effects-interactions pattern.
Additional information: link
ExistFinance.swapBack() (#623-662) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
Ensure that all the return values of the function calls are used.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#254-257) should emit an event for:
- minPeriod = _minPeriod (#255)
- minDistribution = _minDistribution (#256)
ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool) (#708-716) should emit an event for:
- autoBuybackCap = _cap (#710)
- autoBuybackAmount = _amount (#712)
ExistFinance.setBuybackMultiplierSettings(uint256,uint256,uint256) (#718-723) should emit an event for:
- buybackMultiplierNumerator = numerator (#720)
- buybackMultiplierDenominator = denominator (#721)
- buybackMultiplierLength = length (#722)
ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256) (#760-767) should emit an event for:
- lpFee = _lpFee (#761)
- buybackFee = _buybackFee (#762)
- reflectionFee = _reflectionFee (#763)
- varMarketingFee = _varMarketingFee (#764)
- totalFee = _lpFee.add(_buybackFee).add(_reflectionFee).add(_varMarketingFee) (#765)
- feeDenominator = _feeDenominator (#766)
ExistFinance.setSwapBackSettings(bool,uint256) (#774-777) should emit an event for:
- swapThreshold = _amount (#776)
ExistFinance.setTargetLiquidity(uint256,uint256) (#779-782) should emit an event for:
- targetLiquidity = _target (#780)
- targetLiquidityDenominator = _denominator (#781)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#135) lacks a zero-check on :
- owner = adr (#136)
ExistFinance.setFeeReceivers(address,address)._autoLiquidityReceiver (#769) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#770)
ExistFinance.setFeeReceivers(address,address)._varMarketingFeeReceiver (#769) lacks a zero-check on :
- varMarketingFeeReceiver = _varMarketingFeeReceiver (#771)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#326-337) has external calls inside a loop: BETH.transfer(shareholder,amount) (#332)
Favor pull over push strategy for external calls.
Additional information: link
Reentrancy in ExistFinance.constructor() (#442-468):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#444)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#445)
- _balances[msg.sender] = _totalSupply (#466)
- autoLiquidityReceiver = msg.sender (#463)
- distributor = new DividendDistributor(address(router)) (#447)
- isDividendExempt[pair] = true (#454)
- isDividendExempt[address(this)] = true (#455)
- isDividendExempt[DEAD] = true (#456)
- isFeeExempt[msg.sender] = true (#458)
- isFeeExempt[address(this)] = true (#459)
- isFeeExempt[pair] = true (#460)
- isFeeExempt[0x10ED43C718714eb63d5aA57B78B54704E256024E] = true (#461)
- isTimelockExempt[msg.sender] = true (#450)
- isTimelockExempt[DEAD] = true (#451)
- isTimelockExempt[address(this)] = true (#452)
- varMarketingFeeReceiver = msg.sender (#464)
Reentrancy in DividendDistributor.deposit() (#275-293):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#282-287)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#292)
- totalDividends = totalDividends.add(amount) (#291)
Reentrancy in DividendDistributor.distributeDividend(address) (#326-337):
External calls:
- BETH.transfer(shareholder,amount) (#332)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#333)
Reentrancy in DividendDistributor.setShare(address,uint256) (#259-273):
External calls:
- distributeDividend(shareholder) (#261)
- BETH.transfer(shareholder,amount) (#332)
State variables written after the call(s):
- addShareholder(shareholder) (#265)
- shareholderIndexes[shareholder] = shareholders.length (#359)
- removeShareholder(shareholder) (#267)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#365)
- addShareholder(shareholder) (#265)
- shareholders.push(shareholder) (#360)
- removeShareholder(shareholder) (#267)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#364)
- shareholders.pop() (#366)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#270)
Reentrancy in ExistFinance.triggerAutoBuyback() (#684-693):
External calls:
- buyTokens(autoBuybackAmount,DEAD) (#685)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#700-705)
State variables written after the call(s):
- autoBuybackAccumulator = autoBuybackAccumulator.add(autoBuybackAmount) (#691)
- autoBuybackBlockLast = block.number (#690)
- autoBuybackEnabled = false (#692)
- buybackMultiplierTriggeredAt = block.timestamp (#687)
Reentrancy in ExistFinance.triggerManualBuyback(uint256,bool) (#672-678):
External calls:
- buyTokens(amount,DEAD) (#673)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#700-705)
State variables written after the call(s):
- buybackMultiplierTriggeredAt = block.timestamp (#675)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in ExistFinance._transferFrom(address,address,uint256) (#507-555):
External calls:
- swapBack() (#535)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#634-640)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
- distributor.setShare(sender,_balances[sender]) (#544)
- distributor.setShare(recipient,_balances[recipient]) (#548)
- distributor.process(distributorGas) (#551)
External calls sending eth:
- swapBack() (#535)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#553)
Reentrancy in ExistFinance._transferFrom(address,address,uint256) (#507-555):
External calls:
- swapBack() (#535)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#634-640)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
External calls sending eth:
- swapBack() (#535)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#600)
- amountReceived = takeFee(sender,recipient,amount) (#539)
Reentrancy in ExistFinance.constructor() (#442-468):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#444)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#467)
Reentrancy in ExistFinance.swapBack() (#623-662):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#634-640)
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#647)
- (success) = address(varMarketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#648)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#652-659)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#660)
Reentrancy in ExistFinance.triggerAutoBuyback() (#684-693):
External calls:
- buyTokens(autoBuybackAmount,DEAD) (#685)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#700-705)
Event emitted after the call(s):
- BuybackMultiplierActive(buybackMultiplierLength) (#688)
Reentrancy in ExistFinance.triggerManualBuyback(uint256,bool) (#672-678):
External calls:
- buyTokens(amount,DEAD) (#673)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#700-705)
Event emitted after the call(s):
- BuybackMultiplierActive(buybackMultiplierLength) (#676)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#321-324) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#322-323)
ExistFinance._transferFrom(address,address,uint256) (#507-555) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(cooldownTimer[recipient] < block.timestamp,Please wait for 1min between two buys) (#523)
ExistFinance.getTotalFee(bool) (#573-577) uses timestamp for comparisons
Dangerous comparisons:
- selling && buybackMultiplierTriggeredAt.add(buybackMultiplierLength) > block.timestamp (#575)
Avoid relying on block.timestamp.
Additional information: link
DividendDistributor.process(uint256) (#295-319) has costly operations inside a loop:
- currentIndex = 0 (#307)
DividendDistributor.distributeDividend(address) (#326-337) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#331)
DividendDistributor.process(uint256) (#295-319) has costly operations inside a loop:
- currentIndex ++ (#316)
Use a local variable to hold the loop computation result.
Additional information: link
ExistFinance.launch() (#729-731) is never used and should be removed
ExistFinance.launched() (#725-727) is never used and should be removed
ExistFinance.shouldAutoBuyback() (#664-670) is never used and should be removed
ExistFinance.triggerAutoBuyback() (#684-693) is never used and should be removed
Remove unused functions.
Additional information: link
ExistFinance._maxTxAmount (#383) is set pre-construction with a non-constant function or state variable:
- _totalSupply
ExistFinance._maxWalletToken (#385) is set pre-construction with a non-constant function or state variable:
- _totalSupply
ExistFinance.swapThreshold (#438) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 10 / 10000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version0.8.8 (#16) is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
solc-0.8.8 is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Function IDEXRouter.WETH() (#150) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#254) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#254) is not in mixedCase
Variable DividendDistributor._token (#206) is not in mixedCase
Variable DividendDistributor.BETH (#214) is not in mixedCase
Variable DividendDistributor.WBNB (#215) is not in mixedCase
Parameter ExistFinance.tradingStatus(bool)._status (#613) is not in mixedCase
Parameter ExistFinance.cooldownEnabled(bool,uint8)._status (#618) is not in mixedCase
Parameter ExistFinance.cooldownEnabled(bool,uint8)._interval (#618) is not in mixedCase
Parameter ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool)._enabled (#708) is not in mixedCase
Parameter ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool)._cap (#708) is not in mixedCase
Parameter ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool)._amount (#708) is not in mixedCase
Parameter ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool)._period (#708) is not in mixedCase
Parameter ExistFinance.setAutoBuybackSettings(bool,uint256,uint256,uint256,bool)._autoBuybackMultiplier (#708) is not in mixedCase
Parameter ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256)._lpFee (#760) is not in mixedCase
Parameter ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256)._buybackFee (#760) is not in mixedCase
Parameter ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256)._reflectionFee (#760) is not in mixedCase
Parameter ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256)._varMarketingFee (#760) is not in mixedCase
Parameter ExistFinance.setFees(uint256,uint256,uint256,uint256,uint256)._feeDenominator (#760) is not in mixedCase
Parameter ExistFinance.setFeeReceivers(address,address)._autoLiquidityReceiver (#769) is not in mixedCase
Parameter ExistFinance.setFeeReceivers(address,address)._varMarketingFeeReceiver (#769) is not in mixedCase
Parameter ExistFinance.setSwapBackSettings(bool,uint256)._enabled (#774) is not in mixedCase
Parameter ExistFinance.setSwapBackSettings(bool,uint256)._amount (#774) is not in mixedCase
Parameter ExistFinance.setTargetLiquidity(uint256,uint256)._target (#779) is not in mixedCase
Parameter ExistFinance.setTargetLiquidity(uint256,uint256)._denominator (#779) is not in mixedCase
Parameter ExistFinance.setDistributionCriteria(uint256,uint256)._minPeriod (#789) is not in mixedCase
Parameter ExistFinance.setDistributionCriteria(uint256,uint256)._minDistribution (#789) is not in mixedCase
Variable ExistFinance.BETH (#373) is not in mixedCase
Variable ExistFinance.WBNB (#374) is not in mixedCase
Variable ExistFinance.DEAD (#375) is not in mixedCase
Variable ExistFinance.ZERO (#376) is not in mixedCase
Constant ExistFinance._name (#378) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ExistFinance._symbol (#379) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ExistFinance._decimals (#380) is not in UPPER_CASE_WITH_UNDERSCORES
Variable ExistFinance._totalSupply (#382) is not in mixedCase
Variable ExistFinance._maxTxAmount (#383) is not in mixedCase
Variable ExistFinance._maxWalletToken (#385) is not in mixedCase
Variable ExistFinance._balances (#387) is not in mixedCase
Variable ExistFinance._allowances (#388) is not in mixedCase
Variable ExistFinance.cd_factor (#407) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#155) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#156)
Prevent variables from having similar names.
Additional information: link
ExistFinance.slitherConstructorVariables() (#370-821) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#375)
ExistFinance.slitherConstructorVariables() (#370-821) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#376)
ExistFinance.slitherConstructorVariables() (#370-821) uses literals with too many digits:
- _totalSupply = 1 * 1000000000 * (10 ** _decimals) (#382)
ExistFinance.slitherConstructorVariables() (#370-821) uses literals with too many digits:
- distributorGas = 500000 (#430)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
ExistFinance.BETH (#373) is never used in ExistFinance (#370-821)
Remove unused state variables.
Additional information: link
DividendDistributor.WBNB (#215) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#228) should be constant
ExistFinance.BETH (#373) should be constant
ExistFinance.DEAD (#375) should be constant
ExistFinance.WBNB (#374) should be constant
ExistFinance.ZERO (#376) should be constant
ExistFinance._totalSupply (#382) should be constant
ExistFinance.cd_factor (#407) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#107-109)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#114-116)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#135-139)
getTotalFee(bool) should be declared external:
- ExistFinance.getTotalFee(bool) (#573-577)
tradingStatus(bool) should be declared external:
- ExistFinance.tradingStatus(bool) (#613-615)
cooldownEnabled(bool,uint8) should be declared external:
- ExistFinance.cooldownEnabled(bool,uint8) (#618-621)
getUnpaidEarnings(address) should be declared external:
- ExistFinance.getUnpaidEarnings(address) (#797-799)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts