PITI [Pitbull Inu] Token

PitbullInu.contractSwap(uint256) (#519-553) sends eth to arbitrary user
Dangerous calls:
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in PitbullInu._transfer(address,address,uint256) (#478-517):
External calls:
- contractSwap(contractTokenBalance) (#510)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(contractTokenBalance,0,path,address(this),block.timestamp) (#533-541)
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
External calls sending eth:
- contractSwap(contractTokenBalance) (#510)
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
State variables written after the call(s):
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- _liquidityHolders[from] = true (#558)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- _rOwned[from] -= values.rAmount (#673)
- _rOwned[to] += values.rTransferAmount (#674)
- _rOwned[address(this)] += values.tSwap * values.currentRate (#727)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- _rTotal -= values.rFee (#684)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- _tOwned[from] = _tOwned[from] - tAmount (#677)
- _tOwned[to] = _tOwned[to] + values.tTransferAmount (#680)
- _tOwned[address(this)] += values.tSwap (#729)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- antiSnipe = AntiSnipe(address(this)) (#562)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- contractSwapEnabled = true (#564)
Apply the check-effects-interactions pattern.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Contract ownership is not renounced (belongs to a wallet)

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736) performs a multiplication on the result of a division:
-feeAmount = (tAmount * currentFee) / masterTaxDivisor (#715)
-values.tFee = (feeAmount * ratios.reflection) / total (#717)
Consider ordering multiplication before division.

Additional information: link

PitbullInu.setOperator(address).newOperator (#270) lacks a zero-check on :
- operator = newOperator (#277)
Check that the address is not zero.

Additional information: link

PitbullInu._checkLiquidityAdd(address,address) (#555-567) has costly operations inside a loop:
- _hasLiqBeenAdded = true (#560)
PitbullInu._checkLiquidityAdd(address,address) (#555-567) has costly operations inside a loop:
- antiSnipe = AntiSnipe(address(this)) (#562)
PitbullInu._checkLiquidityAdd(address,address) (#555-567) has costly operations inside a loop:
- contractSwapEnabled = true (#564)
PitbullInu.finalizeTransfer(address,address,uint256,bool,bool,bool) (#658-689) has costly operations inside a loop:
- _rTotal -= values.rFee (#684)
PitbullInu.setExcludedFromReward(address,bool) (#599-633) has costly operations inside a loop:
- _excluded.pop() (#627)
Use a local variable to hold the loop computation result.

Additional information: link

Pragma version>=0.6.0<0.9.0 (#2) is too complex
solc-0.8.16 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

PitbullInu.slitherConstructorConstantVariables() (#99-766) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#159)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

Reentrancy in PitbullInu.enableTrading() (#569-580):
External calls:
- antiSnipe.setLaunch(lpPair,uint32(block.number),uint64(block.timestamp),_decimals) (#575)
State variables written after the call(s):
- tradingEnabled = true (#576)
Reentrancy in PitbullInu.finalizeTransfer(address,address,uint256,bool,bool,bool) (#658-689):
External calls:
- values = takeTaxes(from,to,tAmount,takeFee,buy,sell,other) (#671)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
State variables written after the call(s):
- _rOwned[from] -= values.rAmount (#673)
- _rOwned[to] += values.rTransferAmount (#674)
- _rTotal -= values.rFee (#684)
- _tOwned[from] = _tOwned[from] - tAmount (#677)
- _tOwned[to] = _tOwned[to] + values.tTransferAmount (#680)
Reentrancy in PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736):
External calls:
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
State variables written after the call(s):
- _rOwned[address(this)] += values.tSwap * values.currentRate (#727)
- _tOwned[address(this)] += values.tSwap (#729)
Reentrancy in PitbullInu.transferOwner(address) (#245-259):
External calls:
- finalizeTransfer(_owner,newOwner,balanceOf(_owner),false,false,true) (#252)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
State variables written after the call(s):
- _owner = newOwner (#256)
Apply the check-effects-interactions pattern.

Additional information: link

PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool).check (#699) is a local variable never initialized
PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool).values (#692) is a local variable never initialized
PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool).checked (#698) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736) ignores return value by antiSnipe.checkUser(from,to,tAmount) (#699-700)
Ensure that all the return values of the function calls are used.

Additional information: link

PitbullInu.setSwapSettings(uint256,uint256,uint256,uint256) (#426-432) should emit an event for:
- swapThreshold = (_tTotal * thresholdPercent) / thresholdDivisor (#427)
- swapAmount = (_tTotal * amountPercent) / amountDivisor (#428)
PitbullInu.setPriceImpactSwapAmount(uint256) (#434-437) should emit an event for:
- piSwapPercent = priceImpactSwapPercent (#436)
Emit an event for critical parameter changes.

Additional information: link

PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736) has external calls inside a loop: antiSnipe.checkUser(from,to,tAmount) (#699-700)
Favor pull over push strategy for external calls.

Additional information: link

Variable 'PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool).check (#699)' in PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736) potentially used before declaration: checked = check (#700)
Move all variable declarations prior to any usage of the variable, and ensure that reaching a variable declaration does not depend on some conditional if it is used unconditionally.

Additional information: link

Reentrancy in PitbullInu.constructor() (#198-231):
External calls:
- lpPair = IFactoryV2(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#221)
State variables written after the call(s):
- _approve(_owner,address(dexRouter),type()(uint256).max) (#224)
- _allowances[sender][spender] = amount (#316)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#225)
- _allowances[sender][spender] = amount (#316)
- _isExcludedFromFees[_owner] = true (#227)
- _isExcludedFromFees[address(this)] = true (#228)
- _isExcludedFromFees[DEAD] = true (#229)
- _liquidityHolders[_owner] = true (#230)
- lpPairs[lpPair] = true (#222)
Reentrancy in PitbullInu.enableTrading() (#569-580):
External calls:
- antiSnipe.setLaunch(lpPair,uint32(block.number),uint64(block.timestamp),_decimals) (#575)
State variables written after the call(s):
- allowedPresaleExclusion = false (#577)
- swapAmount = (balanceOf(lpPair) * 30) / 10000 (#579)
- swapThreshold = (balanceOf(lpPair) * 10) / 10000 (#578)
Reentrancy in PitbullInu.setNewRouter(address) (#333-345):
External calls:
- lpPair = IFactoryV2(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#338)
State variables written after the call(s):
- _approve(address(this),address(dexRouter),type()(uint256).max) (#344)
- _allowances[sender][spender] = amount (#316)
- dexRouter = _newRouter (#343)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in PitbullInu._transfer(address,address,uint256) (#478-517):
External calls:
- contractSwap(contractTokenBalance) (#510)
- dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(contractTokenBalance,0,path,address(this),block.timestamp) (#533-541)
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
External calls sending eth:
- contractSwap(contractTokenBalance) (#510)
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
Event emitted after the call(s):
- ContractSwapEnabledUpdated(true) (#565)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- Transfer(from,to,values.tTransferAmount) (#687)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
- Transfer(from,address(this),values.tSwap) (#731)
- finalizeTransfer(from,to,amount,buy,sell,other) (#516)
Reentrancy in PitbullInu.constructor() (#198-231):
External calls:
- lpPair = IFactoryV2(dexRouter.factory()).createPair(dexRouter.WETH(),address(this)) (#221)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#317)
- _approve(_owner,address(dexRouter),type()(uint256).max) (#224)
- Approval(sender,spender,amount) (#317)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#225)
Reentrancy in PitbullInu.finalizeTransfer(address,address,uint256,bool,bool,bool) (#658-689):
External calls:
- values = takeTaxes(from,to,tAmount,takeFee,buy,sell,other) (#671)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
Event emitted after the call(s):
- Transfer(from,to,values.tTransferAmount) (#687)
Reentrancy in PitbullInu.setNewRouter(address) (#333-345):
External calls:
- lpPair = IFactoryV2(_newRouter.factory()).createPair(address(this),_newRouter.WETH()) (#338)
Event emitted after the call(s):
- Approval(sender,spender,amount) (#317)
- _approve(address(this),address(dexRouter),type()(uint256).max) (#344)
Reentrancy in PitbullInu.takeTaxes(address,address,uint256,bool,bool,bool,bool) (#691-736):
External calls:
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
Event emitted after the call(s):
- Transfer(from,address(this),values.tSwap) (#731)
Reentrancy in PitbullInu.transferOwner(address) (#245-259):
External calls:
- finalizeTransfer(_owner,newOwner,balanceOf(_owner),false,false,true) (#252)
- antiSnipe.checkUser(from,to,tAmount) (#699-700)
Event emitted after the call(s):
- OwnershipTransferred(oldOwner,newOwner) (#257)
Apply the check-effects-interactions pattern.

Additional information: link

PitbullInu.setLpPair(address,bool) (#347-359) uses timestamp for comparisons
Dangerous comparisons:
- timeSinceLastPair != 0 (#352)
- require(bool,string)(block.timestamp - timeSinceLastPair > 259200,3 Day cooldown.!) (#353)
Avoid relying on block.timestamp.

Additional information: link

Low level call in PitbullInu.contractSwap(uint256) (#519-553):
- (success,None) = _taxWallets.marketing.call{gas: 35000,value: marketingBalance}() (#548)
- (success,None) = _taxWallets.charity.call{gas: 35000,value: charityBalance}() (#551)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IRouter01.WETH() (#33) is not in mixedCase
Parameter PitbullInu.setProtectionSettings(bool,bool)._antiSnipe (#387) is not in mixedCase
Parameter PitbullInu.setProtectionSettings(bool,bool)._antiBlock (#387) is not in mixedCase
Constant PitbullInu.startingSupply (#115) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu._name (#116) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu._symbol (#117) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu._decimals (#118) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu._tTotal (#120) is not in UPPER_CASE_WITH_UNDERSCORES
Variable PitbullInu._taxRates (#137-141) is not in mixedCase
Variable PitbullInu._ratios (#143-148) is not in mixedCase
Constant PitbullInu.maxBuyTaxes (#150) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu.maxSellTaxes (#151) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu.maxTransferTaxes (#152) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu.maxRoundtripTax (#153) is not in UPPER_CASE_WITH_UNDERSCORES
Constant PitbullInu.masterTaxDivisor (#154) is not in UPPER_CASE_WITH_UNDERSCORES
Variable PitbullInu._taxWallets (#166-169) is not in mixedCase
Variable PitbullInu._hasLiqBeenAdded (#180) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#45) is too similar to IRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#46)
Prevent variables from having similar names.

Additional information: link

transfer(address,uint256) should be declared external:
- PitbullInu.transfer(address,uint256) (#302-305)
enableTrading() should be declared external:
- PitbullInu.enableTrading() (#569-580)
isExcludedFromReward(address) should be declared external:
- PitbullInu.isExcludedFromReward(address) (#595-597)
Use the external attribute for functions never called from the contract.

Additional information: link

Contract has 8% buy tax and 7% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Token is deployed only at one blockchain

Token has only one trading pair

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to crawl data from the website

Token is not listed at Mobula.Finance

Additional information: link

Unable to find token on CoinHunt

Additional information: link

Unable to find code repository for the project

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank