INDI [IndigsLegend] Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

IndigsLegend.contractSwap(uint256) (#707-751) sends eth to arbitrary user
Dangerous calls:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in IndigsLegend._transfer(address,address,uint256) (#666-701):
External calls:
- contractSwap(contractTokenBalance) (#696)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- antiSnipe.checkUser(from,to,amount) (#788-792)
External calls sending eth:
- contractSwap(contractTokenBalance) (#696)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
State variables written after the call(s):
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- _liquidityHolders[from] = true (#756)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- _tOwned[address(this)] += feeAmount (#819)
- _tOwned[from] -= amount (#799)
- _tOwned[to] += amountReceived (#801)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- contractSwapEnabled = true (#761)
Reentrancy in IndigsLegend.transferOwner(address) (#462-478):
External calls:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- antiSnipe.checkUser(from,to,amount) (#788-792)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
External calls sending eth:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
State variables written after the call(s):
- _owner = newOwner (#475)
Apply the check-effects-interactions pattern.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Reentrancy in IndigsLegend.enableTrading() (#766-771):
External calls:
- antiSnipe.setLaunch(lpPair,uint32(block.number),uint64(block.timestamp)) (#769)
State variables written after the call(s):
- tradingEnabled = true (#770)
Apply the check-effects-interactions pattern.

Additional information: link

IndigsLegend._finalizeTransfer(address,address,uint256,bool).check (#788) is a local variable never initialized
IndigsLegend._finalizeTransfer(address,address,uint256,bool).checked (#787) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

IndigsLegend.contractSwap(uint256) (#707-751) ignores return value by dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
IndigsLegend._finalizeTransfer(address,address,uint256,bool) (#778-805) ignores return value by antiSnipe.checkUser(from,to,amount) (#788-792)
Ensure that all the return values of the function calls are used.

Additional information: link

IndigsLegend.setMaxTxPercent(uint256,uint256) (#611-616) should emit an event for:
- _maxTxAmount = check (#614)
IndigsLegend.setMaxWalletSize(uint256,uint256) (#618-623) should emit an event for:
- _maxWalletSize = check (#621)
IndigsLegend.setSwapSettings(uint256,uint256,uint256,uint256) (#625-628) should emit an event for:
- swapThreshold = (_tTotal * thresholdPercent) / thresholdDivisor (#626)
- swapAmount = (_tTotal * amountPercent) / amountDivisor (#627)
Emit an event for critical parameter changes.

Additional information: link

IndigsLegend.setWallets(address,address).marketingWallet (#630) lacks a zero-check on :
- _marketingWallet = address(marketingWallet) (#631)
IndigsLegend.setWallets(address,address).buybackWallet (#630) lacks a zero-check on :
- _buybackWallet = address(buybackWallet) (#632)
Check that the address is not zero.

Additional information: link

Variable 'IndigsLegend._finalizeTransfer(address,address,uint256,bool).check (#788)' in IndigsLegend._finalizeTransfer(address,address,uint256,bool) (#778-805) potentially used before declaration: checked = check (#789)
Move all variable declarations prior to any usage of the variable, and ensure that reaching a variable declaration does not depend on some conditional if it is used unconditionally.

Additional information: link

Reentrancy in IndigsLegend._finalizeTransfer(address,address,uint256,bool) (#778-805):
External calls:
- antiSnipe.checkUser(from,to,amount) (#788-792)
State variables written after the call(s):
- _tOwned[from] -= amount (#799)
- _tOwned[to] += amountReceived (#801)
- amountReceived = takeTaxes(from,to,amount) (#800)
- _tOwned[address(this)] += feeAmount (#819)
Reentrancy in IndigsLegend.constructor() (#430-449):
External calls:
- lpPair = IUniswapV2Factory(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#437)
State variables written after the call(s):
- _approve(_msgSender(),_routerAddress,type()(uint256).max) (#440)
- _allowances[sender][spender] = amount (#514)
- _approve(address(this),_routerAddress,type()(uint256).max) (#441)
- _allowances[sender][spender] = amount (#514)
- _isExcludedFromFees[owner()] = true (#443)
- _isExcludedFromFees[address(this)] = true (#444)
- _isExcludedFromFees[DEAD] = true (#445)
- _liquidityHolders[owner()] = true (#446)
- lpPairs[lpPair] = true (#438)
Reentrancy in IndigsLegend.contractSwap(uint256) (#707-751):
External calls:
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
State variables written after the call(s):
- _aAaAliquidityBal = liquidityBalance (#732)
Reentrancy in IndigsLegend.contractSwap(uint256) (#707-751):
External calls:
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
External calls sending eth:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
State variables written after the call(s):
- _aAaAmarketBal = (address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio) (#746)
Reentrancy in IndigsLegend.contractSwap(uint256) (#707-751):
External calls:
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
External calls sending eth:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
State variables written after the call(s):
- _aAaAbuybackBal = address(this).balance (#748)
Reentrancy in IndigsLegend.setNewRouter(address) (#541-552):
External calls:
- lpPair = IUniswapV2Factory(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#545)
State variables written after the call(s):
- _approve(address(this),address(dexRouter),type()(uint256).max) (#551)
- _allowances[sender][spender] = amount (#514)
- dexRouter = _newRouter (#550)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in IndigsLegend._finalizeTransfer(address,address,uint256,bool) (#778-805):
External calls:
- antiSnipe.checkUser(from,to,amount) (#788-792)
Event emitted after the call(s):
- Transfer(from,address(this),feeAmount) (#820)
- amountReceived = takeTaxes(from,to,amount) (#800)
- Transfer(from,to,amountReceived) (#803)
Reentrancy in IndigsLegend._transfer(address,address,uint256) (#666-701):
External calls:
- contractSwap(contractTokenBalance) (#696)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- antiSnipe.checkUser(from,to,amount) (#788-792)
External calls sending eth:
- contractSwap(contractTokenBalance) (#696)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
Event emitted after the call(s):
- ContractSwapEnabledUpdated(true) (#762)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- Transfer(from,address(this),feeAmount) (#820)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- Transfer(from,to,amountReceived) (#803)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
Reentrancy in IndigsLegend.constructor() (#430-449):
External calls:
- lpPair = IUniswapV2Factory(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#437)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#515)
- _approve(address(this),_routerAddress,type()(uint256).max) (#441)
- Approval(sender,spender,amount) (#515)
- _approve(_msgSender(),_routerAddress,type()(uint256).max) (#440)
- Transfer(address(0),_msgSender(),_tTotal) (#448)
Reentrancy in IndigsLegend.contractSwap(uint256) (#707-751):
External calls:
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
External calls sending eth:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
Event emitted after the call(s):
- SwapAndLiquify(toLiquify,liquidityBalance,toLiquify) (#743)
Reentrancy in IndigsLegend.setNewRouter(address) (#541-552):
External calls:
- lpPair = IUniswapV2Factory(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#545)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#515)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#551)
Reentrancy in IndigsLegend.transferOwner(address) (#462-478):
External calls:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- antiSnipe.checkUser(from,to,amount) (#788-792)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(toSwapForEth,0,path,address(this),block.timestamp) (#723-729)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
External calls sending eth:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#476)
Apply the check-effects-interactions pattern.

Additional information: link

IndigsLegend.setLpPair(address,bool) (#554-566) uses timestamp for comparisons
Dangerous comparisons:
- timeSinceLastPair != 0 (#559)
- require(bool,string)(block.timestamp - timeSinceLastPair > 604800,Cannot set a new pair this week!) (#560)
Avoid relying on block.timestamp.

Additional information: link

IndigsLegend.setLpPair(address,bool) (#554-566) compares to a boolean constant:
-enabled == false (#555)
Remove the equality to the boolean constant.

Additional information: link

Context._msgData() (#14-17) is never used and should be removed
Remove unused functions.

Additional information: link

IndigsLegend._decimalsMul (#374) is set pre-construction with a non-constant function or state variable:
- _decimals
IndigsLegend._tTotal (#375) is set pre-construction with a non-constant function or state variable:
- startingSupply * 10 ** _decimalsMul
IndigsLegend._rTotal (#376) is set pre-construction with a non-constant function or state variable:
- (MAX - (MAX % _tTotal))
IndigsLegend._maxTxAmount (#394) is set pre-construction with a non-constant function or state variable:
- (_tTotal * maxTxPercent) / maxTxDivisor
IndigsLegend.maxTxAmountUI (#395) is set pre-construction with a non-constant function or state variable:
- (startingSupply * maxTxPercent) / maxTxDivisor
IndigsLegend._maxWalletSize (#399) is set pre-construction with a non-constant function or state variable:
- (_tTotal * maxWalletPercent) / maxWalletDivisor
IndigsLegend.maxWalletSizeUI (#400) is set pre-construction with a non-constant function or state variable:
- (startingSupply * maxWalletPercent) / maxWalletDivisor
IndigsLegend.swapThreshold (#402) is set pre-construction with a non-constant function or state variable:
- (_tTotal * 5) / 10000
IndigsLegend.swapAmount (#403) is set pre-construction with a non-constant function or state variable:
- (_tTotal * 5) / 1000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version>=0.6.0<0.9.0 (#7) is too complex
solc-0.8.9 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Function IUniswapV2Pair.DOMAIN_SEPARATOR() (#135) is not in mixedCase
Function IUniswapV2Pair.PERMIT_TYPEHASH() (#136) is not in mixedCase
Function IUniswapV2Pair.MINIMUM_LIQUIDITY() (#150) is not in mixedCase
Function IUniswapV2Router01.WETH() (#168) is not in mixedCase
Parameter IndigsLegend.setProtectionSettings(bool,bool,bool)._antiSnipe (#585) is not in mixedCase
Parameter IndigsLegend.setProtectionSettings(bool,bool,bool)._antiGas (#585) is not in mixedCase
Parameter IndigsLegend.setProtectionSettings(bool,bool,bool)._antiBlock (#585) is not in mixedCase
Parameter IndigsLegend.setContractSwapEnabled(bool)._enabled (#635) is not in mixedCase
Constant IndigsLegend._name (#329) is not in UPPER_CASE_WITH_UNDERSCORES
Constant IndigsLegend._symbol (#330) is not in UPPER_CASE_WITH_UNDERSCORES
Variable IndigsLegend._taxRates (#352-356) is not in mixedCase
Variable IndigsLegend._ratios (#358-363) is not in mixedCase
Constant IndigsLegend._routerAddress (#383) is not in UPPER_CASE_WITH_UNDERSCORES
Variable IndigsLegend._hasLiqBeenAdded (#406) is not in mixedCase
Variable IndigsLegend._aAaAmarketBal (#703) is not in mixedCase
Variable IndigsLegend._aAaAliquidityBal (#704) is not in mixedCase
Variable IndigsLegend._aAaAbuybackBal (#705) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#15)" inContext (#9-18)
Remove redundant statements if they congest code but offer no value.

Additional information: link

Reentrancy in IndigsLegend._transfer(address,address,uint256) (#666-701):
External calls:
- contractSwap(contractTokenBalance) (#696)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
External calls sending eth:
- contractSwap(contractTokenBalance) (#696)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
State variables written after the call(s):
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- _hasLiqBeenAdded = true (#757)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- _liquidityHolders[from] = true (#756)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- _tOwned[address(this)] += feeAmount (#819)
- _tOwned[from] -= amount (#799)
- _tOwned[to] += amountReceived (#801)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- antiSnipe = AntiSnipe(address(this)) (#759)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- contractSwapEnabled = true (#761)
Event emitted after the call(s):
- ContractSwapEnabledUpdated(true) (#762)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- Transfer(from,address(this),feeAmount) (#820)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
- Transfer(from,to,amountReceived) (#803)
- _finalizeTransfer(from,to,amount,takeFee) (#700)
Reentrancy in IndigsLegend.contractSwap(uint256) (#707-751):
External calls:
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
External calls sending eth:
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
State variables written after the call(s):
- _aAaAbuybackBal = address(this).balance (#748)
Reentrancy in IndigsLegend.transferOwner(address) (#462-478):
External calls:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
External calls sending eth:
- _transfer(_owner,newOwner,balanceOf(_owner)) (#472)
- dexRouter.addLiquidityETH{value: liquidityBalance}(address(this),toLiquify,0,0,DEAD,block.timestamp) (#735-742)
- _marketingWallet.transfer((address(this).balance * _ratios.liquidityRatio) / (_ratios.marketingRatio + _ratios.buybackRatio)) (#747)
- _buybackWallet.transfer(address(this).balance) (#749)
State variables written after the call(s):
- _owner = newOwner (#475)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#476)
Apply the check-effects-interactions pattern.

Additional information: link

Variable IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#172) is too similar to IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#173)
Prevent variables from having similar names.

Additional information: link

IndigsLegend.slitherConstructorConstantVariables() (#310-825) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#385)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

IndigsLegend._isSniper (#324) is never used in IndigsLegend (#310-825)
IndigsLegend._rTotal (#376) is never used in IndigsLegend (#310-825)
IndigsLegend._tFeeTotal (#377) is never used in IndigsLegend (#310-825)
Remove unused state variables.

Additional information: link

IndigsLegend._decimals (#373) should be constant
IndigsLegend._tFeeTotal (#377) should be constant
IndigsLegend.allowedPresaleExclusion (#323) should be constant
IndigsLegend.maxTxDivisor (#393) should be constant
IndigsLegend.maxTxPercent (#392) should be constant
IndigsLegend.maxWalletDivisor (#398) should be constant
IndigsLegend.maxWalletPercent (#397) should be constant
IndigsLegend.startingSupply (#327) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

renounceOwnership() should be declared external:
- IndigsLegend.renounceOwnership() (#480-484)
transfer(address,uint256) should be declared external:
- IndigsLegend.transfer(address,uint256) (#500-503)
approve(address,uint256) should be declared external:
- IndigsLegend.approve(address,uint256) (#505-508)
approveContractContingency() should be declared external:
- IndigsLegend.approveContractContingency() (#518-521)
increaseAllowance(address,uint256) should be declared external:
- IndigsLegend.increaseAllowance(address,uint256) (#531-534)
decreaseAllowance(address,uint256) should be declared external:
- IndigsLegend.decreaseAllowance(address,uint256) (#536-539)
setNewRouter(address) should be declared external:
- IndigsLegend.setNewRouter(address) (#541-552)
isExcludedFromFees(address) should be declared external:
- IndigsLegend.isExcludedFromFees(address) (#568-570)
setContractSwapEnabled(bool) should be declared external:
- IndigsLegend.setContractSwapEnabled(bool) (#635-638)
enableTrading() should be declared external:
- IndigsLegend.enableTrading() (#766-771)
Use the external attribute for functions never called from the contract.

Additional information: link