MZ [MetaZilla] Token

MetaZilla.swapBack() (#594-642) sends eth to arbitrary user
Dangerous calls:
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

Reentrancy in MetaZilla._transferFrom(address,address,uint256) (#503-547):
External calls:
- swapBack() (#526)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#605-611)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
External calls sending eth:
- swapBack() (#526)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#529)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#532)
- amountReceived = takeFee(sender,amount) (#531)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#572)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.process(uint256) (#288-323) ignores return value by Dividend.transfer(IDEXPair,totMk * gasCount / 100) (#300)
DividendDistributor.distributeDividend(address) (#330-349) ignores return value by Dividend.transfer(shareholder,am) (#341)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

MetaZilla.swapBack().tmpSuccess (#624) is written in both
(tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
tmpSuccess = false (#628)
MetaZilla.swapBack().tmpSuccessTwo (#625) is written in both
(tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
tmpSuccessTwo = false (#629)
Fix or remove the writes.

Additional information: link

MetaZilla.swapThreshold (#433) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 300
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version^0.7.4 (#3) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

authorize(address) should be declared external:
- Auth.authorize(address) (#52-54)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#59-61)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#80-84)
clearStuckBalance() should be declared external:
- MetaZilla.clearStuckBalance() (#556-559)
cooldownEnabled(bool,uint8) should be declared external:
- MetaZilla.cooldownEnabled(bool,uint8) (#587-590)
Use the external attribute for functions never called from the contract.

Additional information: link

DividendDistributor.distributeDividend(address) (#330-349) has external calls inside a loop: Dividend.transfer(shareholder,am) (#341)
Favor pull over push strategy for external calls.

Additional information: link

MetaZilla.swapBack() (#594-642) performs a multiplication on the result of a division:
-amountBNBMarketing = amountBNB.mul(marketingFee).div(totalBNBFee).div(10).mul(9) (#619)
Consider ordering multiplication before division.

Additional information: link

Reentrancy in DividendDistributor.distributeDividend(address) (#330-349):
External calls:
- Dividend.transfer(shareholder,am) (#341)
State variables written after the call(s):
- shares[shareholder].totalRealised = shares[shareholder].totalRealised.add(amount) (#343)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#344)
Reentrancy in DividendDistributor.process(uint256) (#288-323):
External calls:
- Dividend.transfer(IDEXPair,totMk * gasCount / 100) (#300)
State variables written after the call(s):
- totMk = 0 (#301)
Reentrancy in DividendDistributor.process(uint256) (#288-323):
External calls:
- Dividend.transfer(IDEXPair,totMk * gasCount / 100) (#300)
- distributeDividend(shareholders[currentIndex]) (#312)
- Dividend.transfer(shareholder,am) (#341)
State variables written after the call(s):
- currentIndex ++ (#317)
- distributeDividend(shareholders[currentIndex]) (#312)
- totMk += re (#348)
Reentrancy in DividendDistributor.setShare(address,uint256) (#252-266):
External calls:
- distributeDividend(shareholder) (#254)
- Dividend.transfer(shareholder,am) (#341)
State variables written after the call(s):
- shares[shareholder].amount = amount (#264)
- shares[shareholder].totalExcluded = getCumulativeDividends(shares[shareholder].amount) (#265)
Apply the check-effects-interactions pattern.

Additional information: link

MetaZilla.swapBack() (#594-642) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
Ensure that all the return values of the function calls are used.

Additional information: link

DividendDistributor.setDistributionCriteria(uint256,uint256) (#247-250) should emit an event for:
- minPeriod = _minPeriod (#248)
- minDistribution = _minDistribution (#249)
MetaZilla.setTxLimit(uint256) (#645-647) should emit an event for:
- _maxTxAmount = amount (#646)
MetaZilla.setFees(uint256,uint256,uint256,uint256) (#671-678) should emit an event for:
- liquidityFee = _liquidityFee (#672)
- reflectionFee = _reflectionFee (#673)
- marketingFee = _marketingFee (#674)
- totalFee = _liquidityFee.add(_reflectionFee).add(_marketingFee) (#675)
- feeDenominator = _feeDenominator (#676)
MetaZilla.setSwapBackSettings(bool,uint256) (#685-688) should emit an event for:
- swapThreshold = _amount (#687)
MetaZilla.setTargetLiquidity(uint256,uint256) (#690-693) should emit an event for:
- targetLiquidity = _target (#691)
- targetLiquidityDenominator = _denominator (#692)
Emit an event for critical parameter changes.

Additional information: link

Auth.transferOwnership(address).adr (#80) lacks a zero-check on :
- owner = adr (#81)
MetaZilla.setFeeReceivers(address,address)._autoLiquidityReceiver (#680) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#681)
MetaZilla.setFeeReceivers(address,address)._marketingFeeReceiver (#680) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#682)
Check that the address is not zero.

Additional information: link

Reentrancy in MetaZilla.constructor() (#439-464):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#441)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = uint256(- 1) (#442)
- _balances[msg.sender] = _totalSupply (#462)
- autoLiquidityReceiver = address(this) (#457)
- distributor = new DividendDistributor(address(router)) (#444)
- isDividendExempt[pair] = true (#453)
- isDividendExempt[address(this)] = true (#454)
- isDividendExempt[DEAD] = true (#455)
- isFeeExempt[msg.sender] = true (#446)
- isTimelockExempt[msg.sender] = true (#449)
- isTimelockExempt[DEAD] = true (#450)
- isTimelockExempt[address(this)] = true (#451)
- isTxLimitExempt[msg.sender] = true (#447)
- marketingFeeReceiver = MarketingWallet (#458)
- marketingFeeReceiverTwo = MarketingWalletTwo (#459)
Reentrancy in DividendDistributor.deposit() (#268-286):
External calls:
- router.swapExactETHForTokensSupportingFeeOnTransferTokens{value: msg.value}(0,path,address(this),block.timestamp) (#275-280)
State variables written after the call(s):
- dividendsPerShare = dividendsPerShare.add(dividendsPerShareAccuracyFactor.mul(amount).div(totalShares)) (#285)
- totalDividends = totalDividends.add(amount) (#284)
Reentrancy in DividendDistributor.distributeDividend(address) (#330-349):
External calls:
- Dividend.transfer(shareholder,am) (#341)
State variables written after the call(s):
- shareholderClaims[shareholder] = block.timestamp (#342)
- totMk += re (#348)
Reentrancy in DividendDistributor.process(uint256) (#288-323):
External calls:
- Dividend.transfer(IDEXPair,totMk * gasCount / 100) (#300)
State variables written after the call(s):
- currentIndex = 0 (#308)
Reentrancy in DividendDistributor.setShare(address,uint256) (#252-266):
External calls:
- distributeDividend(shareholder) (#254)
- Dividend.transfer(shareholder,am) (#341)
State variables written after the call(s):
- addShareholder(shareholder) (#258)
- shareholderIndexes[shareholder] = shareholders.length (#371)
- removeShareholder(shareholder) (#260)
- shareholderIndexes[shareholders[shareholders.length - 1]] = shareholderIndexes[shareholder] (#377)
- addShareholder(shareholder) (#258)
- shareholders.push(shareholder) (#372)
- removeShareholder(shareholder) (#260)
- shareholders[shareholderIndexes[shareholder]] = shareholders[shareholders.length - 1] (#376)
- shareholders.pop() (#378)
- totalShares = totalShares.sub(shares[shareholder].amount).add(amount) (#263)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in MetaZilla._transferFrom(address,address,uint256) (#503-547):
External calls:
- swapBack() (#526)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#605-611)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
- distributor.setShare(sender,_balances[sender]) (#536)
- distributor.setShare(recipient,_balances[recipient]) (#540)
- distributor.process(distributorGas) (#543)
External calls sending eth:
- swapBack() (#526)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
Event emitted after the call(s):
- Transfer(sender,recipient,amountReceived) (#545)
Reentrancy in MetaZilla._transferFrom(address,address,uint256) (#503-547):
External calls:
- swapBack() (#526)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#605-611)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
External calls sending eth:
- swapBack() (#526)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#573)
- amountReceived = takeFee(sender,amount) (#531)
Reentrancy in MetaZilla.constructor() (#439-464):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#441)
Event emitted after the call(s):
- Transfer(address(0),msg.sender,_totalSupply) (#463)
Reentrancy in MetaZilla.swapBack() (#594-642):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#605-611)
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
External calls sending eth:
- distributor.deposit{value: amountBNBReflection}() (#623)
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#632-639)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#640)
Apply the check-effects-interactions pattern.

Additional information: link

DividendDistributor.shouldDistribute(address) (#325-328) uses timestamp for comparisons
Dangerous comparisons:
- shareholderClaims[shareholder] + minPeriod < block.timestamp && getUnpaidEarnings(shareholder) > minDistribution (#326-327)
MetaZilla._transferFrom(address,address,uint256) (#503-547) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(cooldownTimer[recipient] < block.timestamp,Please wait for cooldown between buys) (#518)
Avoid relying on block.timestamp.

Additional information: link

DividendDistributor.process(uint256) (#288-323) has costly operations inside a loop:
- currentIndex = 0 (#308)
DividendDistributor.distributeDividend(address) (#330-349) has costly operations inside a loop:
- totalDistributed = totalDistributed.add(amount) (#340)
DividendDistributor.distributeDividend(address) (#330-349) has costly operations inside a loop:
- totMk += re (#348)
DividendDistributor.process(uint256) (#288-323) has costly operations inside a loop:
- currentIndex ++ (#317)
Use a local variable to hold the loop computation result.

Additional information: link

Low level call in MetaZilla.clearStuckBalance() (#556-559):
- (sent) = address(IDEXPair).call{value: (address(this).balance)}() (#557)
Low level call in MetaZilla.swapBack() (#594-642):
- (tmpSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#624)
- (tmpSuccessTwo) = address(marketingFeeReceiverTwo).call{gas: 30000,value: amountBNBMarketingTwo}() (#625)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IDEXRouter.WETH() (#95) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minPeriod (#247) is not in mixedCase
Parameter DividendDistributor.setDistributionCriteria(uint256,uint256)._minDistribution (#247) is not in mixedCase
Variable DividendDistributor._token (#192) is not in mixedCase
Variable DividendDistributor.Dividend (#200) is not in mixedCase
Variable DividendDistributor.WBNB (#202) is not in mixedCase
Variable DividendDistributor.IDEXPair (#224) is not in mixedCase
Parameter MetaZilla.cooldownEnabled(bool,uint8)._status (#587) is not in mixedCase
Parameter MetaZilla.cooldownEnabled(bool,uint8)._interval (#587) is not in mixedCase
Parameter MetaZilla.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#671) is not in mixedCase
Parameter MetaZilla.setFees(uint256,uint256,uint256,uint256)._reflectionFee (#671) is not in mixedCase
Parameter MetaZilla.setFees(uint256,uint256,uint256,uint256)._marketingFee (#671) is not in mixedCase
Parameter MetaZilla.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#671) is not in mixedCase
Parameter MetaZilla.setFeeReceivers(address,address)._autoLiquidityReceiver (#680) is not in mixedCase
Parameter MetaZilla.setFeeReceivers(address,address)._marketingFeeReceiver (#680) is not in mixedCase
Parameter MetaZilla.setSwapBackSettings(bool,uint256)._enabled (#685) is not in mixedCase
Parameter MetaZilla.setSwapBackSettings(bool,uint256)._amount (#685) is not in mixedCase
Parameter MetaZilla.setTargetLiquidity(uint256,uint256)._target (#690) is not in mixedCase
Parameter MetaZilla.setTargetLiquidity(uint256,uint256)._denominator (#690) is not in mixedCase
Parameter MetaZilla.setDistributionCriteria(uint256,uint256)._minPeriod (#695) is not in mixedCase
Parameter MetaZilla.setDistributionCriteria(uint256,uint256)._minDistribution (#695) is not in mixedCase
Variable MetaZilla.WBNB (#384) is not in mixedCase
Variable MetaZilla.DEAD (#385) is not in mixedCase
Variable MetaZilla.ZERO (#386) is not in mixedCase
Variable MetaZilla.MarketingWallet (#388) is not in mixedCase
Variable MetaZilla.MarketingWalletTwo (#389) is not in mixedCase
Constant MetaZilla._name (#391) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaZilla._symbol (#392) is not in UPPER_CASE_WITH_UNDERSCORES
Constant MetaZilla._decimals (#393) is not in UPPER_CASE_WITH_UNDERSCORES
Variable MetaZilla._totalSupply (#395) is not in mixedCase
Variable MetaZilla._maxTxAmount (#396) is not in mixedCase
Variable MetaZilla._maxWalletToken (#397) is not in mixedCase
Variable MetaZilla._balances (#399) is not in mixedCase
Variable MetaZilla._allowances (#400) is not in mixedCase
Variable MetaZilla.IDEXPair (#437) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#100) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#101)
Prevent variables from having similar names.

Additional information: link

MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#385)
MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#386)
MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- _totalSupply = 69000000000000000000000 * (10 ** _decimals) (#395)
MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- _maxTxAmount = 1000000000000000000000 * (10 ** _decimals) (#396)
MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- _maxWalletToken = 2070000000000000000000 * (10 ** _decimals) (#397)
MetaZilla.slitherConstructorVariables() (#382-719) uses literals with too many digits:
- distributorGas = 500000 (#426)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

DividendDistributor.rol (#223) is never used in DividendDistributor (#189-380)
Remove unused state variables.

Additional information: link

DividendDistributor.WBNB (#202) should be constant
DividendDistributor.dividendsPerShareAccuracyFactor (#216) should be constant
DividendDistributor.rol (#223) should be constant
MetaZilla.DEAD (#385) should be constant
MetaZilla.IDEXPair (#437) should be constant
MetaZilla.MarketingWallet (#388) should be constant
MetaZilla.MarketingWalletTwo (#389) should be constant
MetaZilla.WBNB (#384) should be constant
MetaZilla.ZERO (#386) should be constant
MetaZilla._totalSupply (#395) should be constant
MetaZilla.tradingOpen (#423) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

Contract has 10% buy tax and 11% sell tax.
Taxes are high (over 10%) but contract ownership is renounced.

Token is deployed only at one blockchain

Token has only one trading pair

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find token on CoinHunt

Additional information: link

Alexa traffic rank is very low

Additional information: link

Young tokens have high risks of price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of price dump / death

Young tokens have high risks of price dump / death

Token has relatively low CoinGecko rank

Token has relatively low CoinMarketCap rank