MetaBull.swapBack() (#726-762) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.
Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Reentrancy in MetaBull._transferFrom(address,address,uint256) (#626-674):
External calls:
- swapBack() (#636)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(swapThreshold,0,path,address(this),block.timestamp) (#733-739)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
External calls sending eth:
- swapBack() (#636)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
State variables written after the call(s):
- _basicTransfer(address(this),DEAD,(rewardsBalanceUnsold.sub(maxContractRewardHold))) (#640-644)
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#681-684)
- _balances[recipient] = _balances[recipient].add(amount) (#685)
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#649-652)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#657)
- amountReceived = takeFee(sender,amount) (#654-656)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#705)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#408-425) ignores return value by REWARDS.transfer(shareholder,amount) (#416)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Contract ownership is not renounced (belongs to a wallet)
MetaBull.swapBack().tmpSuccess (#750) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
tmpSuccess = false (#760)
MetaBull.swapBack().tmpSuccess2 (#754) is written in both
(tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
tmpSuccess2 = false (#761)
Fix or remove the writes.
Additional information: link
Pragma version^0.7.4 (#25) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in MetaBull.swapBack() (#726-762):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#197) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#322) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#323) is not in mixedCase
Variable DividendDistributor._token (#272) is not in mixedCase
Variable DividendDistributor.WBNB (#280) is not in mixedCase
Variable DividendDistributor.REWARDS (#282) is not in mixedCase
Parameter MetaBull.setFeeReceivers(address,address)._marketingFeeReceiver (#782) is not in mixedCase
Parameter MetaBull.setFeeReceivers(address,address)._devFeeReceiver (#783) is not in mixedCase
Parameter MetaBull.setSwapBackSettings(bool,uint256,uint256)._enabled (#790) is not in mixedCase
Parameter MetaBull.setSwapBackSettings(bool,uint256,uint256)._amount (#791) is not in mixedCase
Parameter MetaBull.setSwapBackSettings(bool,uint256,uint256)._maxContractRewardHold (#792) is not in mixedCase
Parameter MetaBull.setDistributionCriteria(uint256,uint256)._minPeriod (#800) is not in mixedCase
Parameter MetaBull.setDistributionCriteria(uint256,uint256)._minDistribution (#801) is not in mixedCase
Variable MetaBull.WBNB (#480) is not in mixedCase
Variable MetaBull.DEAD (#481) is not in mixedCase
Variable MetaBull.ZERO (#482) is not in mixedCase
Constant MetaBull._name (#484) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaBull._symbol (#485) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaBull._decimals (#486) is not in UPPER_CASE_WITH_UNDERSCORES
Variable MetaBull._totalSupply (#488) is not in mixedCase
Variable MetaBull._balances (#490) is not in mixedCase
Variable MetaBull._allowances (#491) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#202) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#203)
Prevent variables from having similar names.
Additional information: link
MetaBull.slitherConstructorVariables() (#477-837) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#481)
MetaBull.slitherConstructorVariables() (#477-837) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#482)
MetaBull.slitherConstructorVariables() (#477-837) uses literals with too many digits:
- distributorGas = 400000 (#516)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#151-153)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#158-160)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#179-183)
isOverLiquified(uint256,uint256) should be declared external:
- MetaBull.isOverLiquified(uint256,uint256) (#823-829)
Use the external attribute for functions never called from the contract.
Additional information: link
DividendDistributor.WBNB (#280) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#295) should be constant
MetaBull.DEAD (#481) should be constant
MetaBull.WBNB (#480) should be constant
MetaBull.ZERO (#482) should be constant
MetaBull._totalSupply (#488) should be constant
MetaBull.devFeeDef (#497) should be constant
MetaBull.feeDenominator (#505) should be constant
MetaBull.marketingFeeDef (#496) should be constant
MetaBull.reflectionFeeDef (#495) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
MetaBull.slitherConstructorVariables() (#477-837) performs a multiplication on the result of a division:
-swapThreshold = (_totalSupply * 1) / 2000 (#519)
-maxContractRewardHold = swapThreshold * 1 (#520)
Consider ordering multiplication before division.
Additional information: link
Reentrancy in DividendDistributor.distributeDividend(address) (#408-425):
External calls:
- REWARDS.transfer(shareholder,amount) (#416)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#418-420)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#421-423)
Reentrancy in DividendDistributor.process(uint256) (#370-396):
External calls:
- distributeDividend(shareholders[currentIndex]) (#388)
- REWARDS.transfer(shareholder,amount) (#416)
State variables written after the call(s):
- currentIndex ++ (#393)
Reentrancy in DividendDistributor.setShare(address,uint256) (#329-349):
External calls:
- distributeDividend(shareholder) (#335)
- REWARDS.transfer(shareholder,amount) (#416)
State variables written after the call(s):
- shares[shareholder].amount = amount (#345)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#346-348)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#321-327) should emit an event for:
- minPeriod = _minPeriod (#325)
- minDistribution = _minDistribution (#326)
MetaBull.setSwapBackSettings(bool,uint256,uint256) (#789-797) should emit an event for:
- swapThreshold = _amount (#795)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#179) lacks a zero-check on :
- owner = adr (#180)
MetaBull.setFeeReceivers(address,address)._marketingFeeReceiver (#782) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#785)
MetaBull.setFeeReceivers(address,address)._devFeeReceiver (#783) lacks a zero-check on :
- devFeeReceiver = _devFeeReceiver (#786)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#408-425) has external calls inside a loop: REWARDS.transfer(shareholder,amount) (#416)
Favor pull over push strategy for external calls.
Additional information: link
Reentrancy in MetaBull.constructor() (#530-554):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#539)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#540)
- _balances[msg.sender] = _totalSupply (#552)
- distributor = new DividendDistributor(address(router)) (#542)
- isDividendExempt[pair] = true (#548)
- isDividendExempt[address(this)] = true (#549)
- isDividendExempt[DEAD] = true (#550)
- isFeeExempt[msg.sender] = true (#544)
- isFeeExempt[marketingFeeReceiver] = true (#545)
- isFeeExempt[DEAD] = true (#546)
Reentrancy in DividendDistributor.deposit() (#351-368):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#358-360)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#365-367)
- totalDividends = totalDividends.add(amount) (#364)
Reentrancy in DividendDistributor.distributeDividend(address) (#408-425):
External calls:
- REWARDS.transfer(shareholder,amount) (#416)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#417)
Reentrancy in DividendDistributor.setShare(address,uint256) (#329-349):
External calls:
- distributeDividend(shareholder) (#335)
- REWARDS.transfer(shareholder,amount) (#416)
State variables written after the call(s):
- addShareholder(shareholder) (#339)
- shareholderIndexes[shareholder] = shareholders.length (#462)
- removeShareholder(shareholder) (#341)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#470-472)
- addShareholder(shareholder) (#339)
- shareholders.push(shareholder) (#463)
- removeShareholder(shareholder) (#341)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#467-469)
- shareholders.pop() (#473)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#344)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in MetaBull._transferFrom(address,address,uint256) (#626-674):
External calls:
- swapBack() (#636)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(swapThreshold,0,path,address(this),block.timestamp) (#733-739)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
External calls sending eth:
- swapBack() (#636)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
Event emitted after the call(s):
- Transfer(sender,recipient,amount) (#686)
- _basicTransfer(address(this),DEAD,(rewardsBalanceUnsold.sub(maxContractRewardHold))) (#640-644)
- Transfer(sender,address(this),feeAmount) (#706)
- amountReceived = takeFee(sender,amount) (#654-656)
Reentrancy in MetaBull._transferFrom(address,address,uint256) (#626-674):
External calls:
- swapBack() (#636)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(swapThreshold,0,path,address(this),block.timestamp) (#733-739)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
- distributor.setShare(sender,_balances[sender]) (#661)
- distributor.setShare(recipient,_balances[recipient]) (#665-667)
- distributor.process(distributorGas) (#670)
External calls sending eth:
- swapBack() (#636)
- distributor.deposit{value: amountBNBReflection}() (#749)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#750-753)
- (tmpSuccess2) = address(devFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#754-757)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#672)
Reentrancy in MetaBull.constructor() (#530-554):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#539)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#553)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#398-406) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#403-405)
Avoid relying on block.timestamp.
Additional information: link
DividendDistributor.process(uint256) (#370-396) has costly operations inside a loop:
- currentIndex = 0 (#384)
DividendDistributor.distributeDividend(address) (#408-425) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#415)
DividendDistributor.process(uint256) (#370-396) has costly operations inside a loop:
- currentIndex ++ (#393)
Use a local variable to hold the loop computation result.
Additional information: link
MetaBull.reflectionFee (#499) is set pre-construction with a non-constant function or state variable:
- reflectionFeeDef
MetaBull.marketingFee (#500) is set pre-construction with a non-constant function or state variable:
- marketingFeeDef
MetaBull.devFee (#501) is set pre-construction with a non-constant function or state variable:
- marketingFeeDef
MetaBull.totalFee (#502-503) is set pre-construction with a non-constant function or state variable:
- reflectionFeeDef.add(marketingFeeDef).add(devFeeDef)
MetaBull.totalSellFee (#504) is set pre-construction with a non-constant function or state variable:
- totalFee.add(2)
MetaBull.swapThreshold (#519) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 1) / 2000
MetaBull.maxContractRewardHold (#520) is set pre-construction with a non-constant function or state variable:
- swapThreshold * 1
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts