McZilla Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

McZilla.swapBack() (#651-693) sends eth to arbitrary user
Dangerous calls:
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in McZilla._transferFrom(address,address,uint256) (#586-612):
External calls:
- swapBack() (#595)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#662-668)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
External calls sending eth:
- swapBack() (#595)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#600)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#603)
- amountReceived = takeFee(sender,recipient,amount) (#602)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#638)
- triggerAutoBuyback() (#596)
- inSwap = true (#531)
- inSwap = false (#531)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.distributeDividend(address) (#425-436) ignores return value by ADA.transfer(shareholder,amount) (#431)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#253) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#254)
Prevent variables from having similar names.

Additional information: link

McZilla.slitherConstructorVariables() (#470-851) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#476)
McZilla.slitherConstructorVariables() (#470-851) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#477)
McZilla.slitherConstructorVariables() (#470-851) uses literals with too many digits:
- _totalSupply = 10000000 * (10 ** _decimals) (#483)
McZilla.slitherConstructorVariables() (#470-851) uses literals with too many digits:
- distributorGas = 500000 (#526)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

McZilla.ADA (#474) is never used in McZilla (#470-851)
Remove unused state variables.

Additional information: link

DividendDistributor.WBNB (#314) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#327) should be constant
McZilla.ADA (#474) should be constant
McZilla.DEAD (#476) should be constant
McZilla.WBNB (#475) should be constant
McZilla.ZERO (#477) should be constant
McZilla._totalSupply (#483) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#226-229)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#235-239)
Use the external attribute for functions never called from the contract.

Additional information: link

Reentrancy in DividendDistributor.distributeDividend(address) (#425-436):
External calls:
- ADA.transfer(shareholder,amount) (#431)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#433)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#434)
Reentrancy in DividendDistributor.process(uint256) (#394-418):
External calls:
- distributeDividend(shareholders[currentIndex]) (#410)
- ADA.transfer(shareholder,amount) (#431)
State variables written after the call(s):
- currentIndex ++ (#415)
Reentrancy in DividendDistributor.setShare(address,uint256) (#357-371):
External calls:
- distributeDividend(shareholder) (#359)
- ADA.transfer(shareholder,amount) (#431)
State variables written after the call(s):
- shares[shareholder].amount = amount (#369)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#370)
Apply the check-effects-interactions pattern.

Additional information: link

McZilla.swapBack() (#651-693) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
Ensure that all the return values of the function calls are used.

Additional information: link

DividendDistributor.setDistributionCriteria(uint256,uint256) (#352-355) should emit an event for:
- minPeriod = _minPeriod (#353)
- minDistribution = _minDistribution (#354)
McZilla.setAutoBuybackSettings(bool,uint256,uint256,uint256) (#735-742) should emit an event for:
- autoBuybackCap = _cap (#737)
- autoBuybackAmount = _amount.div(100) (#739)
McZilla.setTxLimit(uint256) (#759-762) should emit an event for:
- _maxTxAmount = amount.div(100) (#761)
McZilla.setSellMultiplier(uint256) (#769-772) should emit an event for:
- _sellMultiplier = multiplier (#771)
McZilla.setFees(uint256,uint256,uint256,uint256,uint256) (#800-808) should emit an event for:
- liquidityFee = _liquidityFee (#801)
- reflectionFee = _reflectionFee (#803)
- devFee = _devFee (#804)
- totalFee = _liquidityFee.add(_buybackFee).add(_reflectionFee).add(_devFee) (#805)
- feeDenominator = _feeDenominator (#806)
McZilla.setSwapBackSettings(bool,uint256) (#810-814) should emit an event for:
- swapThreshold = _amount.div(100) (#812)
McZilla.setTargetLiquidity(uint256,uint256) (#822-825) should emit an event for:
- targetLiquidity = _target (#823)
- targetLiquidityDenominator = _denominator (#824)
Emit an event for critical parameter changes.

Additional information: link

McZilla.setFeeReceivers(address,address)._autoLiquidityReceiver (#816) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#817)
McZilla.setFeeReceivers(address,address)._devFeeReceiver (#816) lacks a zero-check on :
- devFeeReceiver = _devFeeReceiver (#818)
Check that the address is not zero.

Additional information: link

DividendDistributor.distributeDividend(address) (#425-436) has external calls inside a loop: ADA.transfer(shareholder,amount) (#431)
Favor pull over push strategy for external calls.

Additional information: link

Reentrancy in McZilla._transferFrom(address,address,uint256) (#586-612):
External calls:
- swapBack() (#595)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#662-668)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
External calls sending eth:
- swapBack() (#595)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
State variables written after the call(s):
- launch() (#598)
- launchedAt = block.number (#756)
Reentrancy in McZilla.constructor() (#533-552):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#535)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#536)
- _balances[msg.sender] = _totalSupply (#550)
- autoLiquidityReceiver = owner() (#547)
- devFeeReceiver = address(0x2d7fCB93A65b32Eb81D5a458D1511eFF20737C76) (#548)
- distributor = new DividendDistributor(address(router)) (#538)
- isDividendExempt[pair] = true (#543)
- isDividendExempt[address(this)] = true (#544)
- isDividendExempt[DEAD] = true (#545)
- isDividendExempt[ZERO] = true (#546)
- isFeeExempt[msg.sender] = true (#540)
- isTxLimitExempt[msg.sender] = true (#541)
- isTxLimitExempt[address(router)] = true (#542)
Reentrancy in DividendDistributor.deposit() (#374-392):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#381-386)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#391)
- totalDividends = totalDividends.add(amount) (#390)
Reentrancy in DividendDistributor.distributeDividend(address) (#425-436):
External calls:
- ADA.transfer(shareholder,amount) (#431)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#432)
Reentrancy in DividendDistributor.setShare(address,uint256) (#357-371):
External calls:
- distributeDividend(shareholder) (#359)
- ADA.transfer(shareholder,amount) (#431)
State variables written after the call(s):
- addShareholder(shareholder) (#363)
- shareholderIndexes[shareholder] = shareholders.length (#458)
- removeShareholder(shareholder) (#365)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#464)
- addShareholder(shareholder) (#363)
- shareholders.push(shareholder) (#459)
- removeShareholder(shareholder) (#365)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#463)
- shareholders.pop() (#465)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#368)
Reentrancy in McZilla.triggerAutoBuyback() (#715-720):
External calls:
- buyTokens(autoBuybackAmount,DEAD) (#716)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
State variables written after the call(s):
- autoBuybackAccumulator = autoBuybackAccumulator.add(autoBuybackAmount) (#718)
- autoBuybackBlockLast = block.number (#717)
- autoBuybackEnabled = false (#719)
Reentrancy in McZilla.triggerManualBuyback(uint256,bool) (#703-709):
External calls:
- buyTokens(amount,DEAD) (#704)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
State variables written after the call(s):
- buybackMultiplierTriggeredAt = block.timestamp (#706)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in McZilla._transferFrom(address,address,uint256) (#586-612):
External calls:
- swapBack() (#595)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#662-668)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
- distributor.setShare(sender,_balances[sender]) (#605)
- distributor.setShare(recipient,_balances[recipient]) (#606)
- distributor.process(distributorGas) (#608)
External calls sending eth:
- swapBack() (#595)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#610)
Reentrancy in McZilla._transferFrom(address,address,uint256) (#586-612):
External calls:
- swapBack() (#595)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#662-668)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
External calls sending eth:
- swapBack() (#595)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
- triggerAutoBuyback() (#596)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#639)
- amountReceived = takeFee(sender,recipient,amount) (#602)
Reentrancy in McZilla.constructor() (#533-552):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#535)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#551)
Reentrancy in McZilla.swapBack() (#651-693):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#662-668)
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#678)
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#683-690)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#691)
Reentrancy in McZilla.triggerManualBuyback(uint256,bool) (#703-709):
External calls:
- buyTokens(amount,DEAD) (#704)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#727-732)
Event emitted after the call(s):
- BuybackMultiplierActive(buybackMultiplierLength) (#707)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.shouldDistribute(address) (#420-423) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#421-422)
Avoid relying on block.timestamp.

Additional information: link

Address.isContract(address) (#10-19) uses assembly
- INLINE ASM (#17)
Address._functionCallWithValue(address,bytes,uint256,string) (#46-67) uses assembly
- INLINE ASM (#59-62)
Do not use evm assembly.

Additional information: link

DividendDistributor.process(uint256) (#394-418) has costly operations inside a loop:
- currentIndex = 0 (#406)
DividendDistributor.distributeDividend(address) (#425-436) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#430)
DividendDistributor.process(uint256) (#394-418) has costly operations inside a loop:
- currentIndex ++ (#415)
Use a local variable to hold the loop computation result.

Additional information: link

Address._functionCallWithValue(address,bytes,uint256,string) (#46-67) is never used and should be removed
Address.functionCall(address,bytes) (#29-31) is never used and should be removed
Address.functionCall(address,bytes,string) (#33-35) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#37-39) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#41-44) is never used and should be removed
Address.isContract(address) (#10-19) is never used and should be removed
Address.sendValue(address,uint256) (#21-27) is never used and should be removed
Context._msgData() (#75-78) is never used and should be removed
Remove unused functions.

Additional information: link

McZilla._maxTxAmount (#484) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
McZilla._maxWalletSize (#485) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
McZilla.swapThreshold (#529) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 100
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version^0.7.4 (#6) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in Address.sendValue(address,uint256) (#21-27):
- (success) = recipient.call{value: amount}() (#25)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#46-67):
- (success,returndata) = target.call{value: weiValue}(data) (#50)
Low level call in McZilla.swapBack() (#651-693):
- (success) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#679)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IDEXRouter.WETH() (#248) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#352) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#352) is not in mixedCase
Variable DividendDistributor._token (#304) is not in mixedCase
Variable DividendDistributor.ADA (#313) is not in mixedCase
Variable DividendDistributor.WBNB (#314) is not in mixedCase
Parameter McZilla.setAutoBuybackSettings(bool,uint256,uint256,uint256)._enabled (#735) is not in mixedCase
Parameter McZilla.setAutoBuybackSettings(bool,uint256,uint256,uint256)._cap (#735) is not in mixedCase
Parameter McZilla.setAutoBuybackSettings(bool,uint256,uint256,uint256)._amount (#735) is not in mixedCase
Parameter McZilla.setAutoBuybackSettings(bool,uint256,uint256,uint256)._period (#735) is not in mixedCase
Parameter McZilla.setFees(uint256,uint256,uint256,uint256,uint256)._liquidityFee (#800) is not in mixedCase
Parameter McZilla.setFees(uint256,uint256,uint256,uint256,uint256)._buybackFee (#800) is not in mixedCase
Parameter McZilla.setFees(uint256,uint256,uint256,uint256,uint256)._reflectionFee (#800) is not in mixedCase
Parameter McZilla.setFees(uint256,uint256,uint256,uint256,uint256)._devFee (#800) is not in mixedCase
Parameter McZilla.setFees(uint256,uint256,uint256,uint256,uint256)._feeDenominator (#800) is not in mixedCase
Parameter McZilla.setSwapBackSettings(bool,uint256)._enabled (#810) is not in mixedCase
Parameter McZilla.setSwapBackSettings(bool,uint256)._amount (#810) is not in mixedCase
Parameter McZilla.setFeeReceivers(address,address)._autoLiquidityReceiver (#816) is not in mixedCase
Parameter McZilla.setFeeReceivers(address,address)._devFeeReceiver (#816) is not in mixedCase
Parameter McZilla.setTargetLiquidity(uint256,uint256)._target (#822) is not in mixedCase
Parameter McZilla.setTargetLiquidity(uint256,uint256)._denominator (#822) is not in mixedCase
Parameter McZilla.setDistributionCriteria(uint256,uint256)._minPeriod (#827) is not in mixedCase
Parameter McZilla.setDistributionCriteria(uint256,uint256)._minDistribution (#827) is not in mixedCase
Variable McZilla.ADA (#474) is not in mixedCase
Variable McZilla.WBNB (#475) is not in mixedCase
Variable McZilla.DEAD (#476) is not in mixedCase
Variable McZilla.ZERO (#477) is not in mixedCase
Constant McZilla._name (#479) is not in UPPER_CASE_WITH_UNDERSCORES
Constant McZilla._symbol (#480) is not in UPPER_CASE_WITH_UNDERSCORES
Constant McZilla._decimals (#481) is not in UPPER_CASE_WITH_UNDERSCORES
Variable McZilla._totalSupply (#483) is not in mixedCase
Variable McZilla._maxTxAmount (#484) is not in mixedCase
Variable McZilla._maxWalletSize (#485) is not in mixedCase
Variable McZilla._balances (#487) is not in mixedCase
Variable McZilla._allowances (#488) is not in mixedCase
Variable McZilla._sellMultiplier (#500) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#76)" inContext (#70-79)
Remove redundant statements if they congest code but offer no value.

Additional information: link