MommyInu.swapBack() (#649-691) sends eth to arbitrary user
Dangerous calls:
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in MommyInu._transferFrom(address,address,uint256) (#584-610):
External calls:
- swapBack() (#593)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
External calls sending eth:
- swapBack() (#593)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#598)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#601)
- amountReceived = takeFee(sender,recipient,amount) (#600)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#636)
- triggerAutoBuyback() (#594)
- inSwap = true (#529)
- inSwap = false (#529)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.distributeDividend(address) (#424-435) ignores return value by NONE.transfer(shareholder,amount) (#430)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Contract ownership is not renounced (belongs to a wallet)
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Reentrancy in DividendDistributor.distributeDividend(address) (#424-435):
External calls:
- NONE.transfer(shareholder,amount) (#430)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#432)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#433)
Reentrancy in DividendDistributor.process(uint256) (#393-417):
External calls:
- distributeDividend(shareholders[currentIndex]) (#409)
- NONE.transfer(shareholder,amount) (#430)
State variables written after the call(s):
- currentIndex ++ (#414)
Reentrancy in DividendDistributor.setShare(address,uint256) (#356-370):
External calls:
- distributeDividend(shareholder) (#358)
- NONE.transfer(shareholder,amount) (#430)
State variables written after the call(s):
- shares[shareholder].amount = amount (#368)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#369)
Apply the check-effects-interactions pattern.
Additional information: link
MommyInu.swapBack() (#649-691) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
Ensure that all the return values of the function calls are used.
Additional information: link
DividendDistributor.setDistributionCriteria(uint256,uint256) (#351-354) should emit an event for:
- minPeriod = _minPeriod (#352)
- minDistribution = _minDistribution (#353)
MommyInu.setAutoBuybackSettings(bool,uint256,uint256,uint256) (#733-740) should emit an event for:
- autoBuybackCap = _cap (#735)
- autoBuybackAmount = _amount.div(100) (#737)
MommyInu.setTxLimit(uint256) (#757-760) should emit an event for:
- _maxTxAmount = amount.div(100) (#759)
MommyInu.setSellMultiplier(uint256) (#767-770) should emit an event for:
- _sellMultiplier = multiplier (#769)
MommyInu.setFees(uint256,uint256,uint256,uint256,uint256) (#790-798) should emit an event for:
- liquidityFee = _liquidityFee (#791)
- reflectionFee = _reflectionFee (#793)
- marketingFee = _marketingFee (#794)
- totalFee = _liquidityFee.add(_buybackFee).add(_reflectionFee).add(_marketingFee) (#795)
- feeDenominator = _feeDenominator (#796)
MommyInu.setSwapBackSettings(bool,uint256) (#805-808) should emit an event for:
- swapThreshold = _amount.div(100) (#807)
MommyInu.setTargetLiquidity(uint256,uint256) (#810-813) should emit an event for:
- targetLiquidity = _target (#811)
- targetLiquidityDenominator = _denominator (#812)
Emit an event for critical parameter changes.
Additional information: link
MommyInu.setFeeReceivers(address,address)._autoLiquidityReceiver (#800) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#801)
MommyInu.setFeeReceivers(address,address)._marketingFeeReceiver (#800) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#802)
Check that the address is not zero.
Additional information: link
DividendDistributor.distributeDividend(address) (#424-435) has external calls inside a loop: NONE.transfer(shareholder,amount) (#430)
Favor pull over push strategy for external calls.
Additional information: link
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#225-228)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#234-238)
Use the external attribute for functions never called from the contract.
Additional information: link
Reentrancy in MommyInu._transferFrom(address,address,uint256) (#584-610):
External calls:
- swapBack() (#593)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
External calls sending eth:
- swapBack() (#593)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
State variables written after the call(s):
- launch() (#596)
- launchedAt = block.number (#754)
Reentrancy in MommyInu.constructor() (#531-550):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#533)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#534)
- _balances[msg.sender] = _totalSupply (#548)
- autoLiquidityReceiver = owner() (#545)
- distributor = new DividendDistributor(address(router)) (#536)
- isDividendExempt[pair] = true (#541)
- isDividendExempt[address(this)] = true (#542)
- isDividendExempt[DEAD] = true (#543)
- isDividendExempt[ZERO] = true (#544)
- isFeeExempt[msg.sender] = true (#538)
- isTxLimitExempt[msg.sender] = true (#539)
- isTxLimitExempt[address(router)] = true (#540)
- marketingFeeReceiver = address(0x1bfBfdb97dC22Bf2fd0aE6B6c146A1f913730682) (#546)
Reentrancy in DividendDistributor.deposit() (#373-391):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#380-385)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#390)
- totalDividends = totalDividends.add(amount) (#389)
Reentrancy in DividendDistributor.distributeDividend(address) (#424-435):
External calls:
- NONE.transfer(shareholder,amount) (#430)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#431)
Reentrancy in DividendDistributor.setShare(address,uint256) (#356-370):
External calls:
- distributeDividend(shareholder) (#358)
- NONE.transfer(shareholder,amount) (#430)
State variables written after the call(s):
- addShareholder(shareholder) (#362)
- shareholderIndexes[shareholder] = shareholders.length (#457)
- removeShareholder(shareholder) (#364)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#463)
- addShareholder(shareholder) (#362)
- shareholders.push(shareholder) (#458)
- removeShareholder(shareholder) (#364)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#462)
- shareholders.pop() (#464)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#367)
Reentrancy in MommyInu.triggerAutoBuyback() (#713-718):
External calls:
- buyTokens(autoBuybackAmount,DEAD) (#714)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
State variables written after the call(s):
- autoBuybackAccumulator = autoBuybackAccumulator.add(autoBuybackAmount) (#716)
- autoBuybackBlockLast = block.number (#715)
- autoBuybackEnabled = false (#717)
Reentrancy in MommyInu.triggerManualBuyback(uint256,bool) (#701-707):
External calls:
- buyTokens(amount,DEAD) (#702)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
State variables written after the call(s):
- buybackMultiplierTriggeredAt = block.timestamp (#704)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in MommyInu._transferFrom(address,address,uint256) (#584-610):
External calls:
- swapBack() (#593)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
- distributor.setShare(sender,_balances[sender]) (#603)
- distributor.setShare(recipient,_balances[recipient]) (#604)
- distributor.process(distributorGas) (#606)
External calls sending eth:
- swapBack() (#593)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#608)
Reentrancy in MommyInu._transferFrom(address,address,uint256) (#584-610):
External calls:
- swapBack() (#593)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
External calls sending eth:
- swapBack() (#593)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
- triggerAutoBuyback() (#594)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#637)
- amountReceived = takeFee(sender,recipient,amount) (#600)
Reentrancy in MommyInu.constructor() (#531-550):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#533)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#549)
Reentrancy in MommyInu.swapBack() (#649-691):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#676)
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#681-688)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#689)
Reentrancy in MommyInu.triggerManualBuyback(uint256,bool) (#701-707):
External calls:
- buyTokens(amount,DEAD) (#702)
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: amount}(0,path,to,block.timestamp) (#725-730)
Event emitted after the call(s):
- BuybackMultiplierActive(buybackMultiplierLength) (#705)
Apply the check-effects-interactions pattern.
Additional information: link
DividendDistributor.shouldDistribute(address) (#419-422) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#420-421)
Avoid relying on block.timestamp.
Additional information: link
Address.isContract(address) (#13-18) uses assembly
- INLINE ASM (#16)
Address._functionCallWithValue(address,bytes,uint256,string) (#45-66) uses assembly
- INLINE ASM (#58-61)
Do not use evm assembly.
Additional information: link
DividendDistributor.process(uint256) (#393-417) has costly operations inside a loop:
- currentIndex = 0 (#405)
DividendDistributor.distributeDividend(address) (#424-435) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#429)
DividendDistributor.process(uint256) (#393-417) has costly operations inside a loop:
- currentIndex ++ (#414)
Use a local variable to hold the loop computation result.
Additional information: link
Address._functionCallWithValue(address,bytes,uint256,string) (#45-66) is never used and should be removed
Address.functionCall(address,bytes) (#28-30) is never used and should be removed
Address.functionCall(address,bytes,string) (#32-34) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#36-38) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#40-43) is never used and should be removed
Address.isContract(address) (#13-18) is never used and should be removed
Address.sendValue(address,uint256) (#20-26) is never used and should be removed
Context._msgData() (#74-77) is never used and should be removed
Remove unused functions.
Additional information: link
MommyInu._maxTxAmount (#483) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 100) / 100
MommyInu._maxWalletSize (#484) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 100) / 100
MommyInu.swapThreshold (#527) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 2000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.7.4 (#9) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in Address.sendValue(address,uint256) (#20-26):
- (success) = recipient.call{value: amount}() (#24)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#45-66):
- (success,returndata) = target.call{value: weiValue}(data) (#49)
Low level call in MommyInu.swapBack() (#649-691):
- (success) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBShill}() (#677)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#247) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#351) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#351) is not in mixedCase
Variable DividendDistributor._token (#303) is not in mixedCase
Variable DividendDistributor.NONE (#312) is not in mixedCase
Variable DividendDistributor.WBNB (#313) is not in mixedCase
Parameter MommyInu.setAutoBuybackSettings(bool,uint256,uint256,uint256)._enabled (#733) is not in mixedCase
Parameter MommyInu.setAutoBuybackSettings(bool,uint256,uint256,uint256)._cap (#733) is not in mixedCase
Parameter MommyInu.setAutoBuybackSettings(bool,uint256,uint256,uint256)._amount (#733) is not in mixedCase
Parameter MommyInu.setAutoBuybackSettings(bool,uint256,uint256,uint256)._period (#733) is not in mixedCase
Parameter MommyInu.setFees(uint256,uint256,uint256,uint256,uint256)._liquidityFee (#790) is not in mixedCase
Parameter MommyInu.setFees(uint256,uint256,uint256,uint256,uint256)._buybackFee (#790) is not in mixedCase
Parameter MommyInu.setFees(uint256,uint256,uint256,uint256,uint256)._reflectionFee (#790) is not in mixedCase
Parameter MommyInu.setFees(uint256,uint256,uint256,uint256,uint256)._marketingFee (#790) is not in mixedCase
Parameter MommyInu.setFees(uint256,uint256,uint256,uint256,uint256)._feeDenominator (#790) is not in mixedCase
Parameter MommyInu.setFeeReceivers(address,address)._autoLiquidityReceiver (#800) is not in mixedCase
Parameter MommyInu.setFeeReceivers(address,address)._marketingFeeReceiver (#800) is not in mixedCase
Parameter MommyInu.setSwapBackSettings(bool,uint256)._enabled (#805) is not in mixedCase
Parameter MommyInu.setSwapBackSettings(bool,uint256)._amount (#805) is not in mixedCase
Parameter MommyInu.setTargetLiquidity(uint256,uint256)._target (#810) is not in mixedCase
Parameter MommyInu.setTargetLiquidity(uint256,uint256)._denominator (#810) is not in mixedCase
Parameter MommyInu.setDistributionCriteria(uint256,uint256)._minPeriod (#815) is not in mixedCase
Parameter MommyInu.setDistributionCriteria(uint256,uint256)._minDistribution (#815) is not in mixedCase
Variable MommyInu.NONE (#473) is not in mixedCase
Variable MommyInu.WBNB (#474) is not in mixedCase
Variable MommyInu.DEAD (#475) is not in mixedCase
Variable MommyInu.ZERO (#476) is not in mixedCase
Constant MommyInu._name (#478) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MommyInu._symbol (#479) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MommyInu._decimals (#480) is not in UPPER_CASE_WITH_UNDERSCORES
Variable MommyInu._totalSupply (#482) is not in mixedCase
Variable MommyInu._maxTxAmount (#483) is not in mixedCase
Variable MommyInu._maxWalletSize (#484) is not in mixedCase
Variable MommyInu._balances (#485) is not in mixedCase
Variable MommyInu._allowances (#486) is not in mixedCase
Variable MommyInu._sellMultiplier (#498) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Redundant expression "this (#75)" inContext (#69-78)
Remove redundant statements if they congest code but offer no value.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#252) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#253)
Prevent variables from having similar names.
Additional information: link
DividendDistributor.slitherConstructorVariables() (#300-466) uses literals with too many digits:
- NONE = IERC20(0x0000000000000000000000000000000000000000) (#312)
MommyInu.slitherConstructorVariables() (#469-839) uses literals with too many digits:
- NONE = 0x0000000000000000000000000000000000000000 (#473)
MommyInu.slitherConstructorVariables() (#469-839) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#475)
MommyInu.slitherConstructorVariables() (#469-839) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#476)
MommyInu.slitherConstructorVariables() (#469-839) uses literals with too many digits:
- _totalSupply = 1000000000 * (10 ** _decimals) (#482)
MommyInu.slitherConstructorVariables() (#469-839) uses literals with too many digits:
- distributorGas = 500000 (#524)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
MommyInu.NONE (#473) is never used in MommyInu (#469-839)
Remove unused state variables.
Additional information: link
DividendDistributor.WBNB (#313) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#326) should be constant
MommyInu.DEAD (#475) should be constant
MommyInu.NONE (#473) should be constant
MommyInu.WBNB (#474) should be constant
MommyInu.ZERO (#476) should be constant
MommyInu._totalSupply (#482) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts