KPB [KingPitBull] Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

KingPitBull.addLiquidity(uint256,uint256) (#567-580) sends eth to arbitrary user
Dangerous calls:
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in KingPitBull._transfer(address,address,uint256) (#463-510):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
- _rOwned[address(this)] += rDonation (#384)
- _rOwned[address(this)] += rMarketing (#374)
- _rOwned[address(this)] += rLiquidity (#364)
- _rOwned[sender] = _rOwned[sender] - s.rAmount (#525)
- _rOwned[recipient] = _rOwned[recipient] + s.rTransferAmount (#526)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
- _rTotal -= rRfi (#353)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
- _tOwned[address(this)] += tMarketing (#372)
- _tOwned[address(this)] += tLiquidity (#362)
- _tOwned[sender] = _tOwned[sender] - tAmount (#519)
- _tOwned[address(this)] += tDonation (#382)
- _tOwned[recipient] = _tOwned[recipient] + s.tTransferAmount (#522)
Apply the check-effects-interactions pattern.

Additional information: link

KingPitBull.rescueAnyBEP20Tokens(address,address,uint256) (#671-673) ignores return value by IERC20(_tokenAddr).transfer(_to,_amount) (#672)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.

KingPitBull.swapAndLiquify(uint256,KingPitBull.Taxes) (#539-565) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#549)
-bnbToAddLiquidityWith = unitBalance * temp.liquidity (#550)
KingPitBull.swapAndLiquify(uint256,KingPitBull.Taxes) (#539-565) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#549)
-marketingAmt = unitBalance * 2 * temp.marketing (#557)
KingPitBull.swapAndLiquify(uint256,KingPitBull.Taxes) (#539-565) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#549)
-donationAmt = unitBalance * 2 * temp.donation (#561)
Consider ordering multiplication before division.

Additional information: link

KingPitBull.addLiquidity(uint256,uint256) (#567-580) ignores return value by router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
Ensure that all the return values of the function calls are used.

Additional information: link

KingPitBull.allowance(address,address).owner (#243) shadows:
- Ownable.owner() (#45-47) (function)
KingPitBull._approve(address,address,uint256).owner (#456) shadows:
- Ownable.owner() (#45-47) (function)
Rename the local variables that shadow another component.

Additional information: link

KingPitBull.updateCooldown(bool,uint256) (#622-625) should emit an event for:
- coolDownTime = time * 1 (#623)
KingPitBull.updateSwapTokensAtAmount(uint256) (#627-629) should emit an event for:
- swapTokensAtAmount = amount * 10 ** _decimals (#628)
KingPitBull.updateMaxTxLimit(uint256,uint256) (#650-653) should emit an event for:
- maxBuyLimit = maxBuy * 10 ** decimals() (#651)
- maxSellLimit = maxSell * 10 ** decimals() (#652)
KingPitBull.updateMaxWalletlimit(uint256) (#655-657) should emit an event for:
- maxWalletLimit = amount * 10 ** decimals() (#656)
Emit an event for critical parameter changes.

Additional information: link

KingPitBull.constructor(address)._pair (#199-200) lacks a zero-check on :
- pair = _pair (#203)
KingPitBull.updateMarketingWallet(address).newWallet (#613) lacks a zero-check on :
- marketingWallet = newWallet (#614)
KingPitBull.updateDonationWallet(address).newWallet (#617) lacks a zero-check on :
- donationWallet = newWallet (#618)
KingPitBull.updateRouterAndPair(address,address).newPair (#659) lacks a zero-check on :
- pair = newPair (#661)
Check that the address is not zero.

Additional information: link

Reentrancy in KingPitBull._transfer(address,address,uint256) (#463-510):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
- totFeesPaid.liquidity += tLiquidity (#358)
- totFeesPaid.marketing += tMarketing (#368)
- totFeesPaid.donation += tDonation (#378)
- totFeesPaid.rfi += tRfi (#354)
Reentrancy in KingPitBull.constructor(address) (#197-220):
External calls:
- _pair = IFactory(_router.factory()).createPair(address(this),_router.WETH()) (#199-200)
State variables written after the call(s):
- excludeFromReward(pair) (#205)
- _excluded.push(account) (#314)
- excludeFromReward(pair) (#205)
- _isExcluded[account] = true (#313)
- _isExcludedFromFee[address(this)] = true (#208)
- _isExcludedFromFee[owner()] = true (#209)
- _isExcludedFromFee[marketingWallet] = true (#210)
- _isExcludedFromFee[donationWallet] = true (#211)
- _rOwned[owner()] = _rTotal (#207)
- excludeFromReward(pair) (#205)
- _tOwned[account] = tokenFromReflection(_rOwned[account]) (#311)
- allowedTransfer[address(this)] = true (#213)
- allowedTransfer[owner()] = true (#214)
- allowedTransfer[pair] = true (#215)
- allowedTransfer[marketingWallet] = true (#216)
- allowedTransfer[donationWallet] = true (#217)
- pair = _pair (#203)
- router = _router (#202)
Reentrancy in KingPitBull.swapAndLiquify(uint256,KingPitBull.Taxes) (#539-565):
External calls:
- swapTokensForBNB(toSwap) (#546)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
External calls sending eth:
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
State variables written after the call(s):
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
- _allowances[owner][spender] = amount (#459)
Reentrancy in KingPitBull.transferFrom(address,address,uint256) (#252-260):
External calls:
- _transfer(sender,recipient,amount) (#253)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
External calls sending eth:
- _transfer(sender,recipient,amount) (#253)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
State variables written after the call(s):
- _approve(sender,_msgSender(),currentAllowance - amount) (#257)
- _allowances[owner][spender] = amount (#459)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in KingPitBull._transfer(address,address,uint256) (#463-510):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#501)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- swapAndLiquify(swapTokensAtAmount,taxes) (#502)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
Event emitted after the call(s):
- Transfer(sender,address(this),s.tLiquidity + s.tMarketing + s.tDonation) (#531)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
- Transfer(sender,recipient,s.tTransferAmount) (#535)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#509)
Reentrancy in KingPitBull.constructor(address) (#197-220):
External calls:
- _pair = IFactory(_router.factory()).createPair(address(this),_router.WETH()) (#199-200)
Event emitted after the call(s):
- Transfer(address(0),owner(),_tTotal) (#219)
Reentrancy in KingPitBull.swapAndLiquify(uint256,KingPitBull.Taxes) (#539-565):
External calls:
- swapTokensForBNB(toSwap) (#546)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
External calls sending eth:
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#460)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#554)
Reentrancy in KingPitBull.transferFrom(address,address,uint256) (#252-260):
External calls:
- _transfer(sender,recipient,amount) (#253)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#591-597)
- address(marketingWallet).sendValue(marketingAmt) (#559)
- address(donationWallet).sendValue(donationAmt) (#563)
External calls sending eth:
- _transfer(sender,recipient,amount) (#253)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#572-579)
- (success) = recipient.call{value: amount}() (#98)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#460)
- _approve(sender,_msgSender(),currentAllowance - amount) (#257)
Apply the check-effects-interactions pattern.

Additional information: link

KingPitBull._transfer(address,address,uint256) (#463-510) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(timePassed >= coolDownTime,Cooldown enabled) (#490)
Avoid relying on block.timestamp.

Additional information: link

KingPitBull.setTradingStatus(bool) (#296-300) compares to a boolean constant:
-state == true && genesis_block == 0 (#299)
Remove the equality to the boolean constant.

Additional information: link

KingPitBull.includeInReward(address) (#317-328) has costly operations inside a loop:
- _excluded.pop() (#324)
KingPitBull._reflectRfi(uint256,uint256) (#352-355) has costly operations inside a loop:
- _rTotal -= rRfi (#353)
Use a local variable to hold the loop computation result.

Additional information: link

Context._msgData() (#30-33) is never used and should be removed
Remove unused functions.

Additional information: link

KingPitBull._rTotal (#140) is set pre-construction with a non-constant function or state variable:
- (MAX - (MAX % _tTotal))
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

solc-0.8.11 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in Address.sendValue(address,uint256) (#95-100):
- (success) = recipient.call{value: amount}() (#98)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IRouter.WETH() (#76) is not in mixedCase
Struct KingPitBull.valuesFromGetValues (#174-186) is not in CapWords
Parameter KingPitBull.setTaxes(uint256,uint256,uint256,uint256)._rfi (#342) is not in mixedCase
Parameter KingPitBull.setTaxes(uint256,uint256,uint256,uint256)._marketing (#342) is not in mixedCase
Parameter KingPitBull.setTaxes(uint256,uint256,uint256,uint256)._liquidity (#342) is not in mixedCase
Parameter KingPitBull.setTaxes(uint256,uint256,uint256,uint256)._donation (#342) is not in mixedCase
Parameter KingPitBull.setSellTaxes(uint256,uint256,uint256,uint256)._rfi (#347) is not in mixedCase
Parameter KingPitBull.setSellTaxes(uint256,uint256,uint256,uint256)._marketing (#347) is not in mixedCase
Parameter KingPitBull.setSellTaxes(uint256,uint256,uint256,uint256)._liquidity (#347) is not in mixedCase
Parameter KingPitBull.setSellTaxes(uint256,uint256,uint256,uint256)._donation (#347) is not in mixedCase
Parameter KingPitBull.updateSwapEnabled(bool)._enabled (#631) is not in mixedCase
Parameter KingPitBull.rescueAnyBEP20Tokens(address,address,uint256)._tokenAddr (#671) is not in mixedCase
Parameter KingPitBull.rescueAnyBEP20Tokens(address,address,uint256)._to (#671) is not in mixedCase
Parameter KingPitBull.rescueAnyBEP20Tokens(address,address,uint256)._amount (#671) is not in mixedCase
Constant KingPitBull._decimals (#136) is not in UPPER_CASE_WITH_UNDERSCORES
Variable KingPitBull.genesis_block (#147) is not in mixedCase
Constant KingPitBull._name (#152) is not in UPPER_CASE_WITH_UNDERSCORES
Constant KingPitBull._symbol (#153) is not in UPPER_CASE_WITH_UNDERSCORES
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#31)" inContext (#25-34)
Remove redundant statements if they congest code but offer no value.

Additional information: link

KingPitBull._tTotal (#139) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#54-56)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#58-61)
name() should be declared external:
- KingPitBull.name() (#223-225)
symbol() should be declared external:
- KingPitBull.symbol() (#226-228)
totalSupply() should be declared external:
- KingPitBull.totalSupply() (#234-236)
allowance(address,address) should be declared external:
- KingPitBull.allowance(address,address) (#243-245)
approve(address,uint256) should be declared external:
- KingPitBull.approve(address,uint256) (#247-250)
transferFrom(address,address,uint256) should be declared external:
- KingPitBull.transferFrom(address,address,uint256) (#252-260)
increaseAllowance(address,uint256) should be declared external:
- KingPitBull.increaseAllowance(address,uint256) (#262-265)
decreaseAllowance(address,uint256) should be declared external:
- KingPitBull.decreaseAllowance(address,uint256) (#267-273)
transfer(address,uint256) should be declared external:
- KingPitBull.transfer(address,uint256) (#275-279)
isExcludedFromReward(address) should be declared external:
- KingPitBull.isExcludedFromReward(address) (#281-283)
reflectionFromToken(uint256,bool) should be declared external:
- KingPitBull.reflectionFromToken(uint256,bool) (#285-294)
excludeFromFee(address) should be declared external:
- KingPitBull.excludeFromFee(address) (#330-332)
includeInFee(address) should be declared external:
- KingPitBull.includeInFee(address) (#334-336)
isExcludedFromFee(address) should be declared external:
- KingPitBull.isExcludedFromFee(address) (#338-340)
setTaxes(uint256,uint256,uint256,uint256) should be declared external:
- KingPitBull.setTaxes(uint256,uint256,uint256,uint256) (#342-345)
setSellTaxes(uint256,uint256,uint256,uint256) should be declared external:
- KingPitBull.setSellTaxes(uint256,uint256,uint256,uint256) (#347-350)
rescueAnyBEP20Tokens(address,address,uint256) should be declared external:
- KingPitBull.rescueAnyBEP20Tokens(address,address,uint256) (#671-673)
Use the external attribute for functions never called from the contract.

Additional information: link