McDonald's + Kanye Hype combined into one
@McYeezus
https://twitter.com/mcyeezustoken
Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
McYeezus.swapBack() (#328-369) sends eth to arbitrary user
Dangerous calls:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in McYeezus._transferFrom(address,address,uint256) (#269-289):
External calls:
- swapBack() (#278)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#339-345)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
External calls sending eth:
- swapBack() (#278)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#282)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#285)
- amountReceived = takeFee(sender,recipient,amount) (#284)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#315)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
McYeezus.slitherConstructorVariables() (#184-453) performs a multiplication on the result of a division:
-swapThreshold = _totalSupply / 1000 * 3 (#220)
Consider ordering multiplication before division.
Additional information: link
McYeezus.swapBack() (#328-369) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
Ensure that all the return values of the function calls are used.
Additional information: link
McYeezus.setTxLimit(uint256) (#392-395) should emit an event for:
- _maxTxAmount = amount (#394)
McYeezus.setFees(uint256,uint256,uint256,uint256) (#410-416) should emit an event for:
- liquidityFee = _liquidityFee (#411)
- buybackFee = _buybackFee (#412)
- marketingFee = _marketingFee (#413)
- totalFee = _liquidityFee.add(_buybackFee).add(_marketingFee) (#414)
- feeDenominator = _feeDenominator (#415)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#123) lacks a zero-check on :
- owner = adr (#124)
McYeezus.setFeeReceiver(address,address)._marketingFeeReceiver (#418) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#419)
McYeezus.setFeeReceiver(address,address)._buybackFeeReceiver (#418) lacks a zero-check on :
- buybackFeeReceiver = _buybackFeeReceiver (#420)
Check that the address is not zero.
Additional information: link
Reentrancy in McYeezus._transferFrom(address,address,uint256) (#269-289):
External calls:
- swapBack() (#278)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#339-345)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
External calls sending eth:
- swapBack() (#278)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
State variables written after the call(s):
- launch() (#280)
- launchedAt = block.number (#389)
Reentrancy in McYeezus.constructor() (#224-235):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#226)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#227)
- _balances[_owner] = _totalSupply (#233)
- isFeeExempt[_owner] = true (#230)
- isTxLimitExempt[_owner] = true (#231)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in McYeezus._transferFrom(address,address,uint256) (#269-289):
External calls:
- swapBack() (#278)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#339-345)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
External calls sending eth:
- swapBack() (#278)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#316)
- amountReceived = takeFee(sender,recipient,amount) (#284)
- Transfer(sender,recipient,amountReceived) (#287)
Reentrancy in McYeezus.constructor() (#224-235):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#226)
Event emitted after the call(s):
- Transfer(address(0),_owner,_totalSupply) (#234)
Reentrancy in McYeezus.swapBack() (#328-369):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#339-345)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
External calls sending eth:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#359-366)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#367)
Apply the check-effects-interactions pattern.
Additional information: link
McYeezus.buyTokens(uint256,address) (#371-382) is never used and should be removed
Remove unused functions.
Additional information: link
McYeezus._maxTxAmount (#196) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
McYeezus._maxWalletSize (#197) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 4) / 100
McYeezus.swapThreshold (#220) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 1000 * 3
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in McYeezus.swapBack() (#328-369):
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#353)
- (charitySuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBcharity}() (#355)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#138) is not in mixedCase
Parameter McYeezus.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#410) is not in mixedCase
Parameter McYeezus.setFees(uint256,uint256,uint256,uint256)._buybackFee (#410) is not in mixedCase
Parameter McYeezus.setFees(uint256,uint256,uint256,uint256)._marketingFee (#410) is not in mixedCase
Parameter McYeezus.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#410) is not in mixedCase
Parameter McYeezus.setFeeReceiver(address,address)._marketingFeeReceiver (#418) is not in mixedCase
Parameter McYeezus.setFeeReceiver(address,address)._buybackFeeReceiver (#418) is not in mixedCase
Parameter McYeezus.setSwapBackSettings(bool,uint256)._enabled (#423) is not in mixedCase
Parameter McYeezus.setSwapBackSettings(bool,uint256)._amount (#423) is not in mixedCase
Parameter McYeezus.transferForeignToken(address)._token (#433) is not in mixedCase
Variable McYeezus.WBNB (#187) is not in mixedCase
Variable McYeezus.DEAD (#188) is not in mixedCase
Variable McYeezus.ZERO (#189) is not in mixedCase
Constant McYeezus._name (#191) is not in UPPER_CASE_WITH_UNDERSCORES
Constant McYeezus._symbol (#192) is not in UPPER_CASE_WITH_UNDERSCORES
Constant McYeezus._decimals (#193) is not in UPPER_CASE_WITH_UNDERSCORES
Variable McYeezus._totalSupply (#195) is not in mixedCase
Variable McYeezus._maxTxAmount (#196) is not in mixedCase
Variable McYeezus._maxWalletSize (#197) is not in mixedCase
Variable McYeezus._balances (#199) is not in mixedCase
Variable McYeezus._allowances (#200) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#143) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#144)
Prevent variables from having similar names.
Additional information: link
McYeezus.slitherConstructorVariables() (#184-453) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#188)
McYeezus.slitherConstructorVariables() (#184-453) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#189)
McYeezus.slitherConstructorVariables() (#184-453) uses literals with too many digits:
- _totalSupply = 1000000000 * (10 ** _decimals) (#195)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
McYeezus.DEAD (#188) should be constant
McYeezus.WBNB (#187) should be constant
McYeezus.ZERO (#189) should be constant
McYeezus._totalSupply (#195) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#95-97)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#102-104)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#123-127)
transferForeignToken(address) should be declared external:
- McYeezus.transferForeignToken(address) (#433-437)
isOverLiquified(uint256,uint256) should be declared external:
- McYeezus.isOverLiquified(uint256,uint256) (#447-449)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Twitter account
Telegram account has relatively few subscribers
Unable to find Blog account (Reddit or Medium)
Unable to find Youtube account
Unable to find Discord account