Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
ParabolicSpooky.swapBack() (#380-414) sends eth to arbitrary user
Dangerous calls:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in ParabolicSpooky._transferFrom(address,address,uint256) (#314-334):
External calls:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#391-397)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
External calls sending eth:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#327)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#330)
- amountReceived = takeFee(sender,recipient,amount) (#329)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#367)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
ParabolicSpooky.slitherConstructorVariables() (#227-513) performs a multiplication on the result of a division:
-swapThreshold = _totalSupply / 1000 * 3 (#265)
Consider ordering multiplication before division.
Additional information: link
ParabolicSpooky.addLiquidity(uint256,uint256) (#416-428) ignores return value by router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
Ensure that all the return values of the function calls are used.
Additional information: link
ParabolicSpooky.setTxLimit(uint256) (#451-454) should emit an event for:
- _maxTxAmount = amount (#453)
ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256) (#469-476) should emit an event for:
- liquidityFee = _liquidityFee (#470)
- buybackFee = _buybackFee (#472)
- marketingFee = _marketingFee (#473)
- totalFee = _liquidityFee.add(_buybackFee).add(_marketingFee) (#474)
- feeDenominator = _feeDenominator (#475)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#166) lacks a zero-check on :
- owner = adr (#167)
ParabolicSpooky.setFeeReceiver(address,address)._marketingFeeReceiver (#478) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#479)
ParabolicSpooky.setFeeReceiver(address,address)._buybackFeeReceiver (#478) lacks a zero-check on :
- buybackFeeReceiver = _buybackFeeReceiver (#480)
Check that the address is not zero.
Additional information: link
Reentrancy in ParabolicSpooky._transferFrom(address,address,uint256) (#314-334):
External calls:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#391-397)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
External calls sending eth:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
State variables written after the call(s):
- launch() (#325)
- launchedAt = block.number (#448)
Reentrancy in ParabolicSpooky.constructor() (#269-280):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#271)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#272)
- _balances[_owner] = _totalSupply (#278)
- isFeeExempt[_owner] = true (#275)
- isTxLimitExempt[_owner] = true (#276)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in ParabolicSpooky._transferFrom(address,address,uint256) (#314-334):
External calls:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#391-397)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
External calls sending eth:
- swapBack() (#323)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#368)
- amountReceived = takeFee(sender,recipient,amount) (#329)
- Transfer(sender,recipient,amountReceived) (#332)
Reentrancy in ParabolicSpooky.addLiquidity(uint256,uint256) (#416-428):
External calls:
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
Event emitted after the call(s):
- AutoLiquify(BNBAmount,tokenAmount) (#426)
Reentrancy in ParabolicSpooky.constructor() (#269-280):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#271)
Event emitted after the call(s):
- Transfer(address(0),_owner,_totalSupply) (#279)
Reentrancy in ParabolicSpooky.swapBack() (#380-414):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#391-397)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
- addLiquidity(amountToLiquify,amountBNBLiquidity) (#413)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
External calls sending eth:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
- addLiquidity(amountToLiquify,amountBNBLiquidity) (#413)
- router.addLiquidityETH{value: BNBAmount}(address(this),tokenAmount,0,0,address(this),block.timestamp) (#418-425)
Event emitted after the call(s):
- AutoLiquify(BNBAmount,tokenAmount) (#426)
- addLiquidity(amountToLiquify,amountBNBLiquidity) (#413)
Apply the check-effects-interactions pattern.
Additional information: link
ParabolicSpooky.AntiDumpMultiplier() (#357-362) uses timestamp for comparisons
Dangerous comparisons:
- time_since_start > 1 * hour (#360)
Avoid relying on block.timestamp.
Additional information: link
ParabolicSpooky.buyTokens(uint256,address) (#430-441) is never used and should be removed
Remove unused functions.
Additional information: link
ParabolicSpooky._maxTxAmount (#239) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
ParabolicSpooky._maxWalletSize (#240) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 3) / 100
ParabolicSpooky.swapThreshold (#265) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 1000 * 3
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in ParabolicSpooky.swapBack() (#380-414):
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#406)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#408)
- (DevSuccess) = address(DevFeeReceiver).call{gas: 30000,value: amountBNBDev}() (#410)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IDEXRouter.WETH() (#181) is not in mixedCase
Function ParabolicSpooky.AntiDumpMultiplier() (#357-362) is not in mixedCase
Parameter ParabolicSpooky.addLiquidity(uint256,uint256).BNBAmount (#416) is not in mixedCase
Parameter ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256)._liquidityFee (#469) is not in mixedCase
Parameter ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256)._buybackFee (#469) is not in mixedCase
Parameter ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256)._devFee (#469) is not in mixedCase
Parameter ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256)._marketingFee (#469) is not in mixedCase
Parameter ParabolicSpooky.setFees(uint256,uint256,uint256,uint256,uint256)._feeDenominator (#469) is not in mixedCase
Parameter ParabolicSpooky.setFeeReceiver(address,address)._marketingFeeReceiver (#478) is not in mixedCase
Parameter ParabolicSpooky.setFeeReceiver(address,address)._buybackFeeReceiver (#478) is not in mixedCase
Parameter ParabolicSpooky.setSwapBackSettings(bool,uint256)._enabled (#483) is not in mixedCase
Parameter ParabolicSpooky.setSwapBackSettings(bool,uint256)._amount (#483) is not in mixedCase
Parameter ParabolicSpooky.transferForeignToken(address)._token (#493) is not in mixedCase
Variable ParabolicSpooky.WBNB (#230) is not in mixedCase
Variable ParabolicSpooky.DEAD (#231) is not in mixedCase
Variable ParabolicSpooky.ZERO (#232) is not in mixedCase
Constant ParabolicSpooky._name (#234) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ParabolicSpooky._symbol (#235) is not in UPPER_CASE_WITH_UNDERSCORES
Constant ParabolicSpooky._decimals (#236) is not in UPPER_CASE_WITH_UNDERSCORES
Variable ParabolicSpooky._totalSupply (#238) is not in mixedCase
Variable ParabolicSpooky._maxTxAmount (#239) is not in mixedCase
Variable ParabolicSpooky._maxWalletSize (#240) is not in mixedCase
Variable ParabolicSpooky._balances (#242) is not in mixedCase
Variable ParabolicSpooky._allowances (#243) is not in mixedCase
Variable ParabolicSpooky.DevFeeReceiver (#257) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#186) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#187)
Prevent variables from having similar names.
Additional information: link
ParabolicSpooky.slitherConstructorVariables() (#227-513) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#231)
ParabolicSpooky.slitherConstructorVariables() (#227-513) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#232)
ParabolicSpooky.slitherConstructorVariables() (#227-513) uses literals with too many digits:
- _totalSupply = 100000000000 * (10 ** _decimals) (#238)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
ParabolicSpooky.DEAD (#231) should be constant
ParabolicSpooky.DevFeeReceiver (#257) should be constant
ParabolicSpooky.WBNB (#230) should be constant
ParabolicSpooky.ZERO (#232) should be constant
ParabolicSpooky._totalSupply (#238) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#138-140)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#145-147)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#166-170)
transferForeignToken(address) should be declared external:
- ParabolicSpooky.transferForeignToken(address) (#493-497)
isOverLiquified(uint256,uint256) should be declared external:
- ParabolicSpooky.isOverLiquified(uint256,uint256) (#507-509)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts