Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.
GoldMedal.swapBack() (#586-633) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in GoldMedal._transferFrom(address,address,uint256) (#485-533):
External calls:
- swapBack() (#512)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#597-603)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
External calls sending eth:
- swapBack() (#512)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#515)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#518)
- amountReceived = takeFee(sender,amount) (#517)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#553)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#311-322) ignores return value by MATIC.transfer(shareholder,amount) (#317)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
GoldMedal.swapBack().tmpSuccess (#614) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
tmpSuccess = false (#618)
GoldMedal.swapBack().tmpSuccess2 (#615) is written in both
(tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
tmpSuccess2 = false (#619)
Fix or remove the writes.
Additional information: link
GoldMedal.slitherConstructorVariables() (#355-711) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#360)
GoldMedal.slitherConstructorVariables() (#355-711) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#361)
GoldMedal.slitherConstructorVariables() (#355-711) uses literals with too many digits:
- distributorGas = 500000 (#401)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
GoldMedal.USDT (#358) is never used in GoldMedal (#355-711)
Remove unused state variables.
Additional information: link
Contract ticker (Gold Medal) contains non-alphanumeric characters.
Not a direct threat, but may indicate unreliable intentions of developer. Non-alphanumeric chars (,.;!#*&") are extremely rare among low risk tokens.
DividendDistributor.WBNB (#200) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#213) should be constant
GoldMedal.DEAD (#360) should be constant
GoldMedal.USDT (#358) should be constant
GoldMedal.WBNB (#359) should be constant
GoldMedal.ZERO (#361) should be constant
GoldMedal._totalSupply (#367) should be constant
GoldMedal.launchedAt (#397) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#92-94)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#99-101)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#120-124)
tradingStatus(bool) should be declared external:
- GoldMedal.tradingStatus(bool) (#574-576)
cooldownEnabled(bool,uint8) should be declared external:
- GoldMedal.cooldownEnabled(bool,uint8) (#579-582)
Use the external attribute for functions never called from the contract.
Additional information: link
DividendDistributor.process(uint256) (#280-304) has costly operations inside a loop:
- currentIndex = 0 (#292)
DividendDistributor.distributeDividend(address) (#311-322) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#316)
DividendDistributor.process(uint256) (#280-304) has costly operations inside a loop:
- currentIndex ++ (#301)
Use a local variable to hold the loop computation result.
Additional information: link
GoldMedal._maxTxAmount (#368) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 100 / 100
GoldMedal._maxWalletToken (#371) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 100) / 100
GoldMedal.swapThreshold (#409) is set pre-construction with a non-constant function or state variable:
- _totalSupply * 10 / 10000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.7.4 (#3) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in GoldMedal.swapBack() (#586-633):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#140) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#141)
Variable GoldMedal.setFeeReceivers(address,address,address)._marketingFeeReceiver (#671) is too similar to GoldMedal.marketingFeeReceiver2 (#389)
Prevent variables from having similar names.
Additional information: link
Function IDEXRouter.WETH() (#135) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#239) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#239) is not in mixedCase
Variable DividendDistributor._token (#191) is not in mixedCase
Variable DividendDistributor.MATIC (#199) is not in mixedCase
Variable DividendDistributor.WBNB (#200) is not in mixedCase
Parameter GoldMedal.tradingStatus(bool)._status (#574) is not in mixedCase
Parameter GoldMedal.cooldownEnabled(bool,uint8)._status (#579) is not in mixedCase
Parameter GoldMedal.cooldownEnabled(bool,uint8)._interval (#579) is not in mixedCase
Parameter GoldMedal.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#662) is not in mixedCase
Parameter GoldMedal.setFees(uint256,uint256,uint256,uint256)._reflectionFee (#662) is not in mixedCase
Parameter GoldMedal.setFees(uint256,uint256,uint256,uint256)._marketingFee (#662) is not in mixedCase
Parameter GoldMedal.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#662) is not in mixedCase
Parameter GoldMedal.setFeeReceivers(address,address,address)._autoLiquidityReceiver (#671) is not in mixedCase
Parameter GoldMedal.setFeeReceivers(address,address,address)._marketingFeeReceiver (#671) is not in mixedCase
Parameter GoldMedal.setFeeReceivers(address,address,address)._marketingFeeReceiver2 (#671) is not in mixedCase
Parameter GoldMedal.setSwapBackSettings(bool,uint256)._enabled (#677) is not in mixedCase
Parameter GoldMedal.setSwapBackSettings(bool,uint256)._amount (#677) is not in mixedCase
Parameter GoldMedal.setTargetLiquidity(uint256,uint256)._target (#682) is not in mixedCase
Parameter GoldMedal.setTargetLiquidity(uint256,uint256)._denominator (#682) is not in mixedCase
Parameter GoldMedal.setDistributionCriteria(uint256,uint256)._minPeriod (#687) is not in mixedCase
Parameter GoldMedal.setDistributionCriteria(uint256,uint256)._minDistribution (#687) is not in mixedCase
Variable GoldMedal.USDT (#358) is not in mixedCase
Variable GoldMedal.WBNB (#359) is not in mixedCase
Variable GoldMedal.DEAD (#360) is not in mixedCase
Variable GoldMedal.ZERO (#361) is not in mixedCase
Constant GoldMedal._name (#363) is not in UPPER_CASE_WITH_UNDERSCORES
Constant GoldMedal._symbol (#364) is not in UPPER_CASE_WITH_UNDERSCORES
Constant GoldMedal._decimals (#365) is not in UPPER_CASE_WITH_UNDERSCORES
Variable GoldMedal._totalSupply (#367) is not in mixedCase
Variable GoldMedal._maxTxAmount (#368) is not in mixedCase
Variable GoldMedal._maxWalletToken (#371) is not in mixedCase
Variable GoldMedal._balances (#373) is not in mixedCase
Variable GoldMedal._allowances (#374) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Reentrancy in DividendDistributor.distributeDividend(address) (#311-322):
External calls:
- MATIC.transfer(shareholder,amount) (#317)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#319)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#320)
Reentrancy in DividendDistributor.process(uint256) (#280-304):
External calls:
- distributeDividend(shareholders[currentIndex]) (#296)
- MATIC.transfer(shareholder,amount) (#317)
State variables written after the call(s):
- currentIndex ++ (#301)
Reentrancy in DividendDistributor.setShare(address,uint256) (#244-258):
External calls:
- distributeDividend(shareholder) (#246)
- MATIC.transfer(shareholder,amount) (#317)
State variables written after the call(s):
- shares[shareholder].amount = amount (#256)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#257)
Apply the check-effects-interactions pattern.
Additional information: link
GoldMedal.swapBack() (#586-633) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
Ensure that all the return values of the function calls are used.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#239-242) should emit an event for:
- minPeriod = _minPeriod (#240)
- minDistribution = _minDistribution (#241)
GoldMedal.setTxLimit(uint256) (#636-638) should emit an event for:
- _maxTxAmount = amount (#637)
GoldMedal.setFees(uint256,uint256,uint256,uint256) (#662-669) should emit an event for:
- liquidityFee = _liquidityFee (#663)
- reflectionFee = _reflectionFee (#664)
- marketingFee = _marketingFee (#665)
- totalFee = _liquidityFee.add(_reflectionFee).add(_marketingFee) (#666)
- feeDenominator = _feeDenominator (#667)
GoldMedal.setSwapBackSettings(bool,uint256) (#677-680) should emit an event for:
- swapThreshold = _amount (#679)
GoldMedal.setTargetLiquidity(uint256,uint256) (#682-685) should emit an event for:
- targetLiquidity = _target (#683)
- targetLiquidityDenominator = _denominator (#684)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#120) lacks a zero-check on :
- owner = adr (#121)
GoldMedal.setFeeReceivers(address,address,address)._autoLiquidityReceiver (#671) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#672)
GoldMedal.setFeeReceivers(address,address,address)._marketingFeeReceiver (#671) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#673)
GoldMedal.setFeeReceivers(address,address,address)._marketingFeeReceiver2 (#671) lacks a zero-check on :
- marketingFeeReceiver2 = _marketingFeeReceiver2 (#674)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#311-322) has external calls inside a loop: MATIC.transfer(shareholder,amount) (#317)
Favor pull over push strategy for external calls.
Additional information: link
Reentrancy in GoldMedal.constructor() (#413-446):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#415)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#416)
- _balances[msg.sender] = _totalSupply (#444)
- autoLiquidityReceiver = DEAD (#440)
- distributor = new DividendDistributor(address(router)) (#418)
- isDividendExempt[pair] = true (#434)
- isDividendExempt[address(this)] = true (#435)
- isDividendExempt[DEAD] = true (#436)
- isFeeExempt[msg.sender] = true (#420)
- isTimelockExempt[msg.sender] = true (#424)
- isTimelockExempt[DEAD] = true (#425)
- isTimelockExempt[address(this)] = true (#426)
- isTxLimitExempt[msg.sender] = true (#421)
- marketingFeeReceiver = msg.sender (#441)
- marketingFeeReceiver2 = address(0x5a2f02d23Ed4b67F1321eb883aFd6b2BAc160987) (#442)
Reentrancy in DividendDistributor.deposit() (#260-278):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#267-272)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#277)
- totalDividends = totalDividends.add(amount) (#276)
Reentrancy in DividendDistributor.distributeDividend(address) (#311-322):
External calls:
- MATIC.transfer(shareholder,amount) (#317)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#318)
Reentrancy in DividendDistributor.setShare(address,uint256) (#244-258):
External calls:
- distributeDividend(shareholder) (#246)
- MATIC.transfer(shareholder,amount) (#317)
State variables written after the call(s):
- addShareholder(shareholder) (#250)
- shareholderIndexes[shareholder] = shareholders.length (#344)
- removeShareholder(shareholder) (#252)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#350)
- addShareholder(shareholder) (#250)
- shareholders.push(shareholder) (#345)
- removeShareholder(shareholder) (#252)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#349)
- shareholders.pop() (#351)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#255)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in GoldMedal._transferFrom(address,address,uint256) (#485-533):
External calls:
- swapBack() (#512)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#597-603)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
- distributor.setShare(sender,_balances[sender]) (#522)
- distributor.setShare(recipient,_balances[recipient]) (#526)
- distributor.process(distributorGas) (#529)
External calls sending eth:
- swapBack() (#512)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#531)
Reentrancy in GoldMedal._transferFrom(address,address,uint256) (#485-533):
External calls:
- swapBack() (#512)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#597-603)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
External calls sending eth:
- swapBack() (#512)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#554)
- amountReceived = takeFee(sender,amount) (#517)
Reentrancy in GoldMedal.constructor() (#413-446):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#415)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#445)
Reentrancy in GoldMedal.swapBack() (#586-633):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#597-603)
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#613)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#614)
- (tmpSuccess2) = address(marketingFeeReceiver2).call{gas: 30000,value: amountBNBMarketing}() (#615)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#622-629)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#631)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#306-309) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#307-308)
GoldMedal._transferFrom(address,address,uint256) (#485-533) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(cooldownTimer[recipient] < block.timestamp,Please wait for cooldown between buys) (#503)
Avoid relying on block.timestamp.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts