MRVR [MetaRoyale] Token

MetaRoyale.addLiquidity(uint256,uint256) (contracts/MRVR.sol#374-386) sends eth to arbitrary user
Dangerous calls:
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in MetaRoyale._transferFrom(address,address,uint256) (contracts/MRVR.sol#153-179):
External calls:
- swapBackInBnb() (contracts/MRVR.sol#163)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
- router.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#365-371)
- IERC20(BUSD).transfer(marketingWallet,swappedBusd) (contracts/MRVR.sol#308)
External calls sending eth:
- swapBackInBnb() (contracts/MRVR.sol#163)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (contracts/MRVR.sol#167-170)
- _balances[recipient] = _balances[recipient].add(amountReceived) (contracts/MRVR.sol#175)
- amountReceived = takeFee(sender,amount,recipient) (contracts/MRVR.sol#172-174)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (contracts/MRVR.sol#222)
Apply the check-effects-interactions pattern.

Additional information: link

MetaRoyale.swapBackInBnb() (contracts/MRVR.sol#291-314) ignores return value by IERC20(BUSD).transfer(marketingWallet,swappedBusd) (contracts/MRVR.sol#308)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

MetaRoyale.setFeeReceivers(address)._wallet (contracts/MRVR.sol#392) lacks a zero-check on :
- marketingWallet = _wallet (contracts/MRVR.sol#393)
Check that the address is not zero.

Additional information: link

MetaRoyale.addLiquidity(uint256,uint256) (contracts/MRVR.sol#374-386) ignores return value by router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
Ensure that all the return values of the function calls are used.

Additional information: link

MetaRoyale._approve(address,address,uint256).owner (contracts/MRVR.sol#117) shadows:
- Ownable.owner() (@openzeppelin/contracts/access/Ownable.sol#35-37) (function)
Rename the local variables that shadow another component.

Additional information: link

MetaRoyale.updateBuyFees(uint256,uint256) (contracts/MRVR.sol#255-263) should emit an event for:
- buyTotalFees = marketing.add(liquidity) (contracts/MRVR.sol#261)
MetaRoyale.updateSellFees(uint256,uint256) (contracts/MRVR.sol#265-273) should emit an event for:
- sellTotalFees = marketing.add(liquidity) (contracts/MRVR.sol#271)
MetaRoyale.changeSwapAmount(uint256,uint256) (contracts/MRVR.sol#276-285) should emit an event for:
- liquiditySwap = _liquiditySwap (contracts/MRVR.sol#281)
Emit an event for critical parameter changes.

Additional information: link

Reentrancy in MetaRoyale.constructor() (contracts/MRVR.sol#61-73):
External calls:
- pair = IUniswapV2Factory(router.factory()).createPair(WBNB,address(this)) (contracts/MRVR.sol#63-66)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (contracts/MRVR.sol#67)
- _balances[msg.sender] = _totalSupply (contracts/MRVR.sol#71)
- isFeeExempt[msg.sender] = true (contracts/MRVR.sol#69)
Reentrancy in MetaRoyale.swapAndLiquify(uint256) (contracts/MRVR.sol#316-337):
External calls:
- swapTokensForEth(half) (contracts/MRVR.sol#328)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
External calls sending eth:
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
State variables written after the call(s):
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- _allowances[owner][spender] = amount (contracts/MRVR.sol#124)
Reentrancy in MetaRoyale.swapBackInBnb() (contracts/MRVR.sol#291-314):
External calls:
- swapTokensForTokens(tokensToSwap,BUSD) (contracts/MRVR.sol#302)
- router.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#365-371)
- IERC20(BUSD).transfer(marketingWallet,swappedBusd) (contracts/MRVR.sol#308)
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
External calls sending eth:
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
State variables written after the call(s):
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- _allowances[owner][spender] = amount (contracts/MRVR.sol#124)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in MetaRoyale._transferFrom(address,address,uint256) (contracts/MRVR.sol#153-179):
External calls:
- swapBackInBnb() (contracts/MRVR.sol#163)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
- router.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#365-371)
- IERC20(BUSD).transfer(marketingWallet,swappedBusd) (contracts/MRVR.sol#308)
External calls sending eth:
- swapBackInBnb() (contracts/MRVR.sol#163)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (contracts/MRVR.sol#177)
- Transfer(sender,address(this),feeAmount) (contracts/MRVR.sol#223)
- amountReceived = takeFee(sender,amount,recipient) (contracts/MRVR.sol#172-174)
Reentrancy in MetaRoyale.constructor() (contracts/MRVR.sol#61-73):
External calls:
- pair = IUniswapV2Factory(router.factory()).createPair(WBNB,address(this)) (contracts/MRVR.sol#63-66)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (contracts/MRVR.sol#72)
Reentrancy in MetaRoyale.swapAndLiquify(uint256) (contracts/MRVR.sol#316-337):
External calls:
- swapTokensForEth(half) (contracts/MRVR.sol#328)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
External calls sending eth:
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
Event emitted after the call(s):
- Approval(owner,spender,amount) (contracts/MRVR.sol#125)
- addLiquidity(otherHalf,newBalance) (contracts/MRVR.sol#334)
- AutoLiquify(newBalance,otherHalf) (contracts/MRVR.sol#336)
Reentrancy in MetaRoyale.swapBackInBnb() (contracts/MRVR.sol#291-314):
External calls:
- swapTokensForTokens(tokensToSwap,BUSD) (contracts/MRVR.sol#302)
- router.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#365-371)
- IERC20(BUSD).transfer(marketingWallet,swappedBusd) (contracts/MRVR.sol#308)
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (contracts/MRVR.sol#346-352)
External calls sending eth:
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (contracts/MRVR.sol#378-385)
Event emitted after the call(s):
- Approval(owner,spender,amount) (contracts/MRVR.sol#125)
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
- AutoLiquify(newBalance,otherHalf) (contracts/MRVR.sol#336)
- swapAndLiquify(tokensToLiquidity) (contracts/MRVR.sol#312)
Apply the check-effects-interactions pattern.

Additional information: link

Different versions of Solidity is used:
- Version used: ['>=0.5.0', '>=0.6.2', '^0.8.0', '^0.8.7']
- ^0.8.0 (@openzeppelin/contracts/access/Ownable.sol#4)
- ^0.8.0 (@openzeppelin/contracts/token/ERC20/IERC20.sol#4)
- ^0.8.0 (@openzeppelin/contracts/utils/Context.sol#4)
- ^0.8.0 (@openzeppelin/contracts/utils/math/SafeMath.sol#4)
- >=0.5.0 (@uniswap/v2-core/contracts/interfaces/IUniswapV2Factory.sol#1)
- >=0.6.2 (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router01.sol#1)
- >=0.6.2 (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router02.sol#1)
- ^0.8.7 (contracts/MRVR.sol#3)
Use one Solidity version.

Additional information: link

Context._msgData() (@openzeppelin/contracts/utils/Context.sol#21-23) is never used and should be removed
SafeMath.div(uint256,uint256,string) (@openzeppelin/contracts/utils/math/SafeMath.sol#191-200) is never used and should be removed
SafeMath.mod(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#151-153) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (@openzeppelin/contracts/utils/math/SafeMath.sol#217-226) is never used and should be removed
SafeMath.tryAdd(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#22-28) is never used and should be removed
SafeMath.tryDiv(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#64-69) is never used and should be removed
SafeMath.tryMod(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#76-81) is never used and should be removed
SafeMath.tryMul(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#47-57) is never used and should be removed
SafeMath.trySub(uint256,uint256) (@openzeppelin/contracts/utils/math/SafeMath.sol#35-40) is never used and should be removed
Remove unused functions.

Additional information: link

MetaRoyale.swapThreshold (contracts/MRVR.sol#53) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 10) / 10000
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version^0.8.0 (@openzeppelin/contracts/access/Ownable.sol#4) allows old versions
Pragma version^0.8.0 (@openzeppelin/contracts/token/ERC20/IERC20.sol#4) allows old versions
Pragma version^0.8.0 (@openzeppelin/contracts/utils/Context.sol#4) allows old versions
Pragma version^0.8.0 (@openzeppelin/contracts/utils/math/SafeMath.sol#4) allows old versions
Pragma version>=0.5.0 (@uniswap/v2-core/contracts/interfaces/IUniswapV2Factory.sol#1) allows old versions
Pragma version>=0.6.2 (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router01.sol#1) allows old versions
Pragma version>=0.6.2 (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router02.sol#1) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Function IUniswapV2Router01.WETH() (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router01.sol#5) is not in mixedCase
Parameter MetaRoyale.changeSwapAmount(uint256,uint256)._marketingSwap (contracts/MRVR.sol#276) is not in mixedCase
Parameter MetaRoyale.changeSwapAmount(uint256,uint256)._liquiditySwap (contracts/MRVR.sol#276) is not in mixedCase
Parameter MetaRoyale.setGetFeesOnNormalTx(bool)._status (contracts/MRVR.sol#287) is not in mixedCase
Parameter MetaRoyale.setFeeReceivers(address)._wallet (contracts/MRVR.sol#392) is not in mixedCase
Parameter MetaRoyale.setSwapBackSettings(bool,uint256)._enabled (contracts/MRVR.sol#396) is not in mixedCase
Parameter MetaRoyale.setSwapBackSettings(bool,uint256)._amount (contracts/MRVR.sol#396) is not in mixedCase
Variable MetaRoyale.WBNB (contracts/MRVR.sol#14) is not in mixedCase
Variable MetaRoyale.DEAD (contracts/MRVR.sol#15) is not in mixedCase
Variable MetaRoyale.ZERO (contracts/MRVR.sol#16) is not in mixedCase
Variable MetaRoyale.BUSD (contracts/MRVR.sol#17) is not in mixedCase
Constant MetaRoyale._name (contracts/MRVR.sol#19) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaRoyale._symbol (contracts/MRVR.sol#20) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaRoyale._decimals (contracts/MRVR.sol#21) is not in UPPER_CASE_WITH_UNDERSCORES
Variable MetaRoyale._totalSupply (contracts/MRVR.sol#23) is not in mixedCase
Variable MetaRoyale._balances (contracts/MRVR.sol#25) is not in mixedCase
Variable MetaRoyale._allowances (contracts/MRVR.sol#26) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router01.sol#10) is too similar to IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (@uniswap/v2-periphery/contracts/interfaces/IUniswapV2Router01.sol#11)
Prevent variables from having similar names.

Additional information: link

MetaRoyale.slitherConstructorVariables() (contracts/MRVR.sol#11-403) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (contracts/MRVR.sol#15)
MetaRoyale.slitherConstructorVariables() (contracts/MRVR.sol#11-403) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (contracts/MRVR.sol#16)
MetaRoyale.slitherConstructorVariables() (contracts/MRVR.sol#11-403) uses literals with too many digits:
- _totalSupply = 300000000 * (10 ** _decimals) (contracts/MRVR.sol#23)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

MetaRoyale.DEAD (contracts/MRVR.sol#15) is never used in MetaRoyale (contracts/MRVR.sol#11-403)
MetaRoyale.ZERO (contracts/MRVR.sol#16) is never used in MetaRoyale (contracts/MRVR.sol#11-403)
Remove unused state variables.

Additional information: link

MetaRoyale.BUSD (contracts/MRVR.sol#17) should be constant
MetaRoyale.DEAD (contracts/MRVR.sol#15) should be constant
MetaRoyale.WBNB (contracts/MRVR.sol#14) should be constant
MetaRoyale.ZERO (contracts/MRVR.sol#16) should be constant
MetaRoyale._totalSupply (contracts/MRVR.sol#23) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (@openzeppelin/contracts/access/Ownable.sol#54-56)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (@openzeppelin/contracts/access/Ownable.sol#62-65)
name() should be declared external:
- MetaRoyale.name() (contracts/MRVR.sol#81-83)
symbol() should be declared external:
- MetaRoyale.symbol() (contracts/MRVR.sol#85-87)
decimals() should be declared external:
- MetaRoyale.decimals() (contracts/MRVR.sol#89-91)
balanceOf(address) should be declared external:
- MetaRoyale.balanceOf(address) (contracts/MRVR.sol#93-95)
updateUniswapRouter(address) should be declared external:
- MetaRoyale.updateUniswapRouter(address) (contracts/MRVR.sol#242-253)
updateBuyFees(uint256,uint256) should be declared external:
- MetaRoyale.updateBuyFees(uint256,uint256) (contracts/MRVR.sol#255-263)
updateSellFees(uint256,uint256) should be declared external:
- MetaRoyale.updateSellFees(uint256,uint256) (contracts/MRVR.sol#265-273)
changeSwapAmount(uint256,uint256) should be declared external:
- MetaRoyale.changeSwapAmount(uint256,uint256) (contracts/MRVR.sol#276-285)
setGetFeesOnNormalTx(bool) should be declared external:
- MetaRoyale.setGetFeesOnNormalTx(bool) (contracts/MRVR.sol#287-289)
Use the external attribute for functions never called from the contract.

Additional information: link

Number of Binance Smart Chain (BSC) token holders is low.

Token is deployed only at one blockchain

Token has only one trading pair

Contract has 4% buy tax and 4% sell tax.
Taxes are low and contract ownership is renounced.

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find code repository for the project

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank

Alexa traffic rank is relatively low

Additional information: link

Young tokens have high risks of price dump / death

Token has relatively low CoinMarketCap rank