MIX [MixMarvel] Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

Reentrancy in TokenVesting.release(IERC20) (#830-840):
External calls:
- token.safeTransfer(_beneficiary,unreleased) (#837)
Event emitted after the call(s):
- TokensReleased(address(token),unreleased) (#839)
Reentrancy in TokenVesting.revoke(IERC20) (#847-861):
External calls:
- token.safeTransfer(owner(),refund) (#858)
Event emitted after the call(s):
- TokenVestingRevoked(address(token)) (#860)
Apply the check-effects-interactions pattern.

Additional information: link

TokenVesting._vestedAmount(IERC20) (#875-888) performs a multiplication on the result of a division:
-currentPhase = (block.timestamp - _start).div(everyPhaseDuration) (#885)
-totalBalance.div(_phase).mul(currentPhase) (#886)
Consider ordering multiplication before division.

Additional information: link

ERC20Detailed.constructor(string,string,uint8).name (#96) shadows:
- ERC20Detailed.name() (#105-107) (function)
ERC20Detailed.constructor(string,string,uint8).symbol (#96) shadows:
- ERC20Detailed.symbol() (#112-114) (function)
ERC20Detailed.constructor(string,string,uint8).decimals (#96) shadows:
- ERC20Detailed.decimals() (#119-121) (function)
ERC20Capped.constructor(uint256).cap (#611) shadows:
- ERC20Capped.cap() (#619-621) (function)
TokenVesting.constructor(address,uint256,uint256,uint256,bool).beneficiary (#764) shadows:
- TokenVesting.beneficiary() (#780-782) (function)
TokenVesting.constructor(address,uint256,uint256,uint256,bool).start (#764) shadows:
- TokenVesting.start() (#794-796) (function)
TokenVesting.constructor(address,uint256,uint256,uint256,bool).phase (#764) shadows:
- TokenVesting.phase() (#787-789) (function)
TokenVesting.constructor(address,uint256,uint256,uint256,bool).duration (#764) shadows:
- TokenVesting.duration() (#801-803) (function)
TokenVesting.constructor(address,uint256,uint256,uint256,bool).revocable (#764) shadows:
- TokenVesting.revocable() (#808-810) (function)
MixMarvelToken.constructor(string,string,uint8,uint256).name (#897) shadows:
- ERC20Detailed.name() (#105-107) (function)
MixMarvelToken.constructor(string,string,uint8,uint256).symbol (#897) shadows:
- ERC20Detailed.symbol() (#112-114) (function)
MixMarvelToken.constructor(string,string,uint8,uint256).decimals (#897) shadows:
- ERC20Detailed.decimals() (#119-121) (function)
MixMarvelToken.constructor(string,string,uint8,uint256).cap (#897) shadows:
- ERC20Capped.cap() (#619-621) (function)
MixMarvelToken.transfer(address,uint256,string).name (#927) shadows:
- ERC20Detailed.name() (#105-107) (function)
Rename the local variables that shadow another component.

Additional information: link

TokenVesting.constructor(address,uint256,uint256,uint256,bool) (#764-775) uses timestamp for comparisons
Dangerous comparisons:
- require(bool)(start.add(duration) > block.timestamp) (#768)
TokenVesting.release(IERC20) (#830-840) uses timestamp for comparisons
Dangerous comparisons:
- require(bool)(unreleased > 0) (#833)
TokenVesting._vestedAmount(IERC20) (#875-888) uses timestamp for comparisons
Dangerous comparisons:
- block.timestamp < _start (#879)
- block.timestamp >= _start.add(_duration) || _revoked[address(token)] (#881)
Avoid relying on block.timestamp.

Additional information: link

Void constructor called in MixMarvelToken.constructor(string,string,uint8,uint256) (#897):
- ERC20() (#897)
Remove the constructor call.

Additional information: link

Address.isContract(address) (#651-662) uses assembly
- INLINE ASM (#660)
Do not use evm assembly.

Additional information: link

SafeERC20.safeApprove(IERC20,address,uint256) (#677-683) is never used and should be removed
SafeERC20.safeDecreaseAllowance(IERC20,address,uint256) (#690-693) is never used and should be removed
SafeERC20.safeIncreaseAllowance(IERC20,address,uint256) (#685-688) is never used and should be removed
SafeERC20.safeTransferFrom(IERC20,address,address,uint256) (#673-675) is never used and should be removed
SafeMath.mod(uint256,uint256) (#79-82) is never used and should be removed
Remove unused functions.

Additional information: link

Pragma version^0.5.0 (#1) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in SafeERC20.callOptionalReturn(IERC20,bytes) (#701-719):
- (success,returndata) = address(token).call(data) (#713)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Parameter MixMarvelToken.mintVesting(address,uint256,uint256,uint256,uint256,bool)._to (#899) is not in mixedCase
Parameter MixMarvelToken.mintVesting(address,uint256,uint256,uint256,uint256,bool)._amount (#899) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

name() should be declared external:
- ERC20Detailed.name() (#105-107)
symbol() should be declared external:
- ERC20Detailed.symbol() (#112-114)
decimals() should be declared external:
- ERC20Detailed.decimals() (#119-121)
balanceOf(address) should be declared external:
- ERC20.balanceOf(address) (#145-147)
allowance(address,address) should be declared external:
- ERC20.allowance(address,address) (#155-157)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#333-336)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#342-344)
addPauser(address) should be declared external:
- PauserRole.addPauser(address) (#416-418)
renouncePauser() should be declared external:
- PauserRole.renouncePauser() (#420-422)
addBurner(address) should be declared external:
- BurnRole.addBurner(address) (#456-458)
renounceBurner() should be declared external:
- BurnRole.renounceBurner() (#460-462)
addMinter(address) should be declared external:
- MinterRole.addMinter(address) (#496-498)
renounceMinter() should be declared external:
- MinterRole.renounceMinter() (#500-502)
paused() should be declared external:
- Pausable.paused() (#532-534)
pause() should be declared external:
- Pausable.pause() (#555-558)
unpause() should be declared external:
- Pausable.unpause() (#563-566)
cap() should be declared external:
- ERC20Capped.cap() (#619-621)
burn(uint256) should be declared external:
- ERC20Burnable.burn(uint256) (#634-637)
beneficiary() should be declared external:
- TokenVesting.beneficiary() (#780-782)
phase() should be declared external:
- TokenVesting.phase() (#787-789)
start() should be declared external:
- TokenVesting.start() (#794-796)
duration() should be declared external:
- TokenVesting.duration() (#801-803)
revocable() should be declared external:
- TokenVesting.revocable() (#808-810)
released(address) should be declared external:
- TokenVesting.released(address) (#815-817)
revoked(address) should be declared external:
- TokenVesting.revoked(address) (#822-824)
release(IERC20) should be declared external:
- TokenVesting.release(IERC20) (#830-840)
revoke(IERC20) should be declared external:
- TokenVesting.revoke(IERC20) (#847-861)
mintVesting(address,uint256,uint256,uint256,uint256,bool) should be declared external:
- MixMarvelToken.mintVesting(address,uint256,uint256,uint256,uint256,bool) (#899-903)
revokeVesting(TokenVesting) should be declared external:
- MixMarvelToken.revokeVesting(TokenVesting) (#905-909)
transferTo(address,uint256) should be declared external:
- MixMarvelToken.transferTo(address,uint256) (#916-919)
transfer(address,uint256,string) should be declared external:
- MixMarvelToken.transfer(address,uint256,string) (#927-931)
transfer(address[],uint256) should be declared external:
- MixMarvelToken.transfer(address[],uint256) (#938-946)
transfer(address[],uint256[]) should be declared external:
- MixMarvelToken.transfer(address[],uint256[]) (#953-962)
Use the external attribute for functions never called from the contract.

Additional information: link

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find token contract audit

Unable to find audit link on the website

Token is not listed at Mobula.Finance

Additional information: link

Unable to find token on CoinHunt

Additional information: link

Unable to find code repository for the project

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of price dump / death