Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505) sends eth to arbitrary user
Dangerous calls:
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
Mycoin.addLiquidity(uint256,uint256) (Mycoin.sol#522-537) sends eth to arbitrary user
Dangerous calls:
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in Mycoin._transfer(address,address,uint256) (Mycoin.sol#445-489):
External calls:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
External calls sending eth:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
State variables written after the call(s):
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
- _BNBFee = _previousBNBFee (Mycoin.sol#437)
- _BNBFee = 0 (Mycoin.sol#432)
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
- _balances[sender] = senderBalance - amount (Mycoin.sol#546)
- _balances[recipient] += tTransferAmount (Mycoin.sol#548)
- _balances[address(this)] += amount - tTransferAmount (Mycoin.sol#549)
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
- _liquidityFee = _previousLiquidityFee (Mycoin.sol#438)
- _liquidityFee = 0 (Mycoin.sol#433)
Apply the check-effects-interactions pattern.
Additional information: link
Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505) uses a dangerous strict equality:
- require(bool,string)(success == true,Transfer failed.) (Mycoin.sol#503)
Don't use strict equality to determine if an account has enough Ether or tokens.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505) performs a multiplication on the result of a division:
-liquidBalance = tokenBalance * _liquidityFee / (_liquidityFee + _BNBFee) / 2 (Mycoin.sol#494)
-bnbForLiquid = newBalance * liquidBalance / tokenBalance (Mycoin.sol#499)
Consider ordering multiplication before division.
Additional information: link
Mycoin.addLiquidity(uint256,uint256) (Mycoin.sol#522-537) ignores return value by pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
Ensure that all the return values of the function calls are used.
Additional information: link
Reentrancy in Mycoin._transfer(address,address,uint256) (Mycoin.sol#445-489):
External calls:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
External calls sending eth:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
State variables written after the call(s):
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
- _previousBNBFee = _BNBFee (Mycoin.sol#429)
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
- _previousLiquidityFee = _liquidityFee (Mycoin.sol#430)
Reentrancy in Mycoin.constructor() (Mycoin.sol#367-377):
External calls:
- pancakeswapV2Pair = IPancakeswapV2Factory(_pancakeswapV2Router.factory()).createPair(address(this),_pancakeswapV2Router.WETH()) (Mycoin.sol#371-372)
State variables written after the call(s):
- _mint(msg.sender,total) (Mycoin.sol#374)
- _balances[account] += amount (Mycoin.sol#270)
- _isExcludedFromFee[msg.sender] = true (Mycoin.sol#375)
- _isExcludedFromFee[address(this)] = true (Mycoin.sol#376)
- _mint(msg.sender,total) (Mycoin.sol#374)
- _totalSupply += amount (Mycoin.sol#269)
Reentrancy in Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505):
External calls:
- swapTokensForEth(tokenBalance) (Mycoin.sol#496)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
External calls sending eth:
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
State variables written after the call(s):
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- _allowances[owner][spender] = amount (Mycoin.sol#320)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in Mycoin._transfer(address,address,uint256) (Mycoin.sol#445-489):
External calls:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
External calls sending eth:
- swapAndCharge(tokenBalance) (Mycoin.sol#473)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
Event emitted after the call(s):
- Transfer(sender,recipient,tTransferAmount) (Mycoin.sol#551)
- _tokenTransfer(sender,recipient,amount,takeFee) (Mycoin.sol#488)
Reentrancy in Mycoin.constructor() (Mycoin.sol#367-377):
External calls:
- pancakeswapV2Pair = IPancakeswapV2Factory(_pancakeswapV2Router.factory()).createPair(address(this),_pancakeswapV2Router.WETH()) (Mycoin.sol#371-372)
Event emitted after the call(s):
- Transfer(address(0),account,amount) (Mycoin.sol#271)
- _mint(msg.sender,total) (Mycoin.sol#374)
Reentrancy in Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505):
External calls:
- swapTokensForEth(tokenBalance) (Mycoin.sol#496)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
External calls sending eth:
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
Event emitted after the call(s):
- Approval(owner,spender,amount) (Mycoin.sol#321)
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
Reentrancy in Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505):
External calls:
- swapTokensForEth(tokenBalance) (Mycoin.sol#496)
- pancakeswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (Mycoin.sol#513-519)
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
External calls sending eth:
- addLiquidity(liquidBalance,bnbForLiquid) (Mycoin.sol#500)
- pancakeswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (Mycoin.sol#524-531)
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
Event emitted after the call(s):
- SwapAndCharged(tokenBalance,liquidBalance,newBalance - bnbForLiquid,bnbForLiquid) (Mycoin.sol#504)
Apply the check-effects-interactions pattern.
Additional information: link
Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505) compares to a boolean constant:
-require(bool,string)(success == true,Transfer failed.) (Mycoin.sol#503)
Remove the equality to the boolean constant.
Additional information: link
Different versions of Solidity is used:
- Version used: ['^0.8.0', '^0.8.4']
- ^0.8.0 (Context.sol#2)
- ^0.8.0 (IERC20.sol#2)
- ^0.8.0 (IERC20Metadata.sol#2)
- ^0.8.4 (Mycoin.sol#2)
- ^0.8.0 (Ownable.sol#2)
Use one Solidity version.
Additional information: link
Context._msgData() (Context.sol#19-21) is never used and should be removed
ERC20._burn(address,uint256) (Mycoin.sol#286-297) is never used and should be removed
ERC20._transfer(address,address,uint256) (Mycoin.sol#239-255) is never used and should be removed
Remove unused functions.
Additional information: link
Mycoin._previousBNBFee (Mycoin.sol#332) is set pre-construction with a non-constant function or state variable:
- _BNBFee
Mycoin._previousLiquidityFee (Mycoin.sol#335) is set pre-construction with a non-constant function or state variable:
- _liquidityFee
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.8.0 (Context.sol#2) allows old versions
Pragma version^0.8.0 (IERC20.sol#2) allows old versions
Pragma version^0.8.0 (IERC20Metadata.sol#2) allows old versions
Pragma version^0.8.0 (Ownable.sol#2) allows old versions
solc-0.8.11 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in Mycoin.swapAndCharge(uint256) (Mycoin.sol#491-505):
- (success) = address(bnbPoolAddress).call{value: newBalance - bnbForLiquid}() (Mycoin.sol#502)
Low level call in Mycoin.addLiquidity(uint256,uint256) (Mycoin.sol#522-537):
- (success) = address(bnbPoolAddress).call{value: balance}() (Mycoin.sol#534)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IPancakeswapV2Router02.WETH() (Mycoin.sol#15) is not in mixedCase
Variable ERC20._balances (Mycoin.sol#58) is not in mixedCase
Parameter Mycoin.setSwapAndLiquifyEnabled(bool)._enabled (Mycoin.sol#416) is not in mixedCase
Constant Mycoin.total (Mycoin.sol#329) is not in UPPER_CASE_WITH_UNDERSCORES
Variable Mycoin._BNBFee (Mycoin.sol#331) is not in mixedCase
Variable Mycoin._liquidityFee (Mycoin.sol#334) is not in mixedCase
Variable Mycoin._maxTxAmount (Mycoin.sol#343) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Mycoin.slitherConstructorConstantVariables() (Mycoin.sol#326-555) uses literals with too many digits:
- total = 1000000000 * 1e18 (Mycoin.sol#329)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
name() should be declared external:
- ERC20.name() (Mycoin.sol#80-82)
symbol() should be declared external:
- ERC20.symbol() (Mycoin.sol#88-90)
decimals() should be declared external:
- ERC20.decimals() (Mycoin.sol#105-107)
totalSupply() should be declared external:
- ERC20.totalSupply() (Mycoin.sol#112-114)
transfer(address,uint256) should be declared external:
- ERC20.transfer(address,uint256) (Mycoin.sol#131-134)
allowance(address,address) should be declared external:
- ERC20.allowance(address,address) (Mycoin.sol#139-141)
approve(address,uint256) should be declared external:
- ERC20.approve(address,uint256) (Mycoin.sol#150-153)
transferFrom(address,address,uint256) should be declared external:
- ERC20.transferFrom(address,address,uint256) (Mycoin.sol#168-182)
increaseAllowance(address,uint256) should be declared external:
- ERC20.increaseAllowance(address,uint256) (Mycoin.sol#196-199)
decreaseAllowance(address,uint256) should be declared external:
- ERC20.decreaseAllowance(address,uint256) (Mycoin.sol#215-223)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (Ownable.sol#52-54)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (Ownable.sol#60-63)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Twitter account
Unable to find Blog account (Reddit or Medium)
Unable to find Youtube account
Unable to find Discord account