REBASEAPY Token

Reentrancy in RebaseAPY._transferFrom(address,address,uint256) (#599-640):
External calls:
- rebase() (#613)
- pairContract.sync() (#555)
- addLiquidity() (#617)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#702-708)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
- swapBack() (#621)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#739-745)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
External calls sending eth:
- addLiquidity() (#617)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
- swapBack() (#621)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
State variables written after the call(s):
- _gonBalances[sender] = _gonBalances[sender].sub(gonAmount) (#625)
- _gonBalances[recipient] = _gonBalances[recipient].add(gonAmountReceived) (#629-631)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#626-628)
- _gonBalances[burnHole] = _gonBalances[burnHole].add(gonAmount.div(feeDenominator).mul(burnHoleFee)) (#667-669)
- _gonBalances[address(this)] = _gonBalances[address(this)].add(gonAmount.div(feeDenominator).mul(_treasuryFee.add(rebaseapyInsuranceFundFee))) (#670-672)
- _gonBalances[autoLiquidityReceiver] = _gonBalances[autoLiquidityReceiver].add(gonAmount.div(feeDenominator).mul(liquidityFee)) (#673-675)
- swapBack() (#621)
- inSwap = true (#459)
- inSwap = false (#461)
Apply the check-effects-interactions pattern.

Additional information: link

RebaseAPY._name (#413) shadows:
- ERC20Detailed._name (#377)
RebaseAPY._symbol (#414) shadows:
- ERC20Detailed._symbol (#378)
RebaseAPY._decimals (#415) shadows:
- ERC20Detailed._decimals (#379)
Remove the state variable shadowing.

Additional information: link

RebaseAPY.swapBack() (#725-763) sends eth to arbitrary user
Dangerous calls:
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Contract ownership is not renounced (belongs to a wallet)

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

RebaseAPY.swapBack().success (#751) is written in both
(success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
(success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
Fix or remove the writes.

Additional information: link

Function IPancakeSwapPair.DOMAIN_SEPARATOR() (#139) is not in mixedCase
Function IPancakeSwapPair.PERMIT_TYPEHASH() (#140) is not in mixedCase
Function IPancakeSwapPair.MINIMUM_LIQUIDITY() (#157) is not in mixedCase
Function IPancakeSwapRouter.WETH() (#177) is not in mixedCase
Parameter RebaseAPY.setEnableAntiBot(bool)._enable (#765) is not in mixedCase
Parameter RebaseAPY.setAutoRebase(bool)._flag (#818) is not in mixedCase
Parameter RebaseAPY.setAutoAddLiquidity(bool)._flag (#827) is not in mixedCase
Parameter RebaseAPY.checkFeeExempt(address)._addr (#890) is not in mixedCase
Parameter RebaseAPY.setFeeReceivers(address,address,address,address)._autoLiquidityReceiver (#910) is not in mixedCase
Parameter RebaseAPY.setFeeReceivers(address,address,address,address)._treasuryReceiver (#911) is not in mixedCase
Parameter RebaseAPY.setFeeReceivers(address,address,address,address)._rebaseapyInsuranceFundReceiver (#912) is not in mixedCase
Parameter RebaseAPY.setFeeReceivers(address,address,address,address)._burnHole (#913) is not in mixedCase
Parameter RebaseAPY.setWhitelist(address)._addr (#931) is not in mixedCase
Parameter RebaseAPY.setBotBlacklist(address,bool)._botAddress (#935) is not in mixedCase
Parameter RebaseAPY.setBotBlacklist(address,bool)._flag (#935) is not in mixedCase
Parameter RebaseAPY.setPairAddress(address)._pairAddress (#940) is not in mixedCase
Parameter RebaseAPY.setLP(address)._address (#944) is not in mixedCase
Variable RebaseAPY._name (#413) is not in mixedCase
Variable RebaseAPY._symbol (#414) is not in mixedCase
Variable RebaseAPY._decimals (#415) is not in mixedCase
Variable RebaseAPY._isFeeExempt (#418) is not in mixedCase
Variable RebaseAPY.DEAD (#446) is not in mixedCase
Variable RebaseAPY.ZERO (#447) is not in mixedCase
Variable RebaseAPY._autoRebase (#469) is not in mixedCase
Variable RebaseAPY._autoAddLiquidity (#470) is not in mixedCase
Variable RebaseAPY._initRebaseStartTime (#471) is not in mixedCase
Variable RebaseAPY._lastRebasedTime (#472) is not in mixedCase
Variable RebaseAPY._lastAddLiquidityTime (#473) is not in mixedCase
Variable RebaseAPY._totalSupply (#474) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#182) is too similar to IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#183)
Prevent variables from having similar names.

Additional information: link

RebaseAPY.slitherConstructorVariables() (#404-964) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#446)
RebaseAPY.slitherConstructorVariables() (#404-964) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#447)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

SafeMathInt.MAX_INT256 (#6) is never used in SafeMathInt (#4-38)
Remove unused state variables.

Additional information: link

RebaseAPY.DEAD (#446) should be constant
RebaseAPY.ZERO (#447) should be constant
RebaseAPY._decimals (#415) should be constant
RebaseAPY._name (#413) should be constant
RebaseAPY._symbol (#414) should be constant
RebaseAPY.burnHoleFee (#439) should be constant
RebaseAPY.feeDenominator (#444) should be constant
RebaseAPY.liquidityFee (#432) should be constant
RebaseAPY.rebaseapyInsuranceFundFee (#434) should be constant
RebaseAPY.sellFeef (#438) should be constant
RebaseAPY.sellFeel (#435) should be constant
RebaseAPY.sellFees (#437) should be constant
RebaseAPY.sellFeet (#436) should be constant
RebaseAPY.swapEnabled (#454) should be constant
RebaseAPY.treasuryFee (#433) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

RebaseAPY.rebase().rebaseRate (#530) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

RebaseAPY.rebase() (#527-558) uses timestamp for comparisons
Dangerous comparisons:
- deltaTimeFromInit < (31536000) (#536)
- deltaTimeFromInit >= (7 * 31536000) (#538)
- deltaTimeFromInit >= ((15 * 31536000) / 10) (#540)
- deltaTimeFromInit >= (31536000) (#542)
- i < times (#546)
RebaseAPY.shouldRebase() (#795-802) uses timestamp for comparisons
Dangerous comparisons:
- _autoRebase && (_totalSupply < MAX_SUPPLY) && msg.sender != pair && ! inSwap && block.timestamp >= (_lastRebasedTime + 600) (#796-801)
RebaseAPY.shouldAddLiquidity() (#804-810) uses timestamp for comparisons
Dangerous comparisons:
- _autoAddLiquidity && ! inSwap && msg.sender != pair && block.timestamp >= (_lastAddLiquidityTime + 600) (#805-809)
Avoid relying on block.timestamp.

Additional information: link

RebaseAPY.rebase() (#527-558) performs a multiplication on the result of a division:
-times = deltaTime.div(600) (#533)
-epoch = times.mul(10) (#534)
RebaseAPY.rebase() (#527-558) performs a multiplication on the result of a division:
-times = deltaTime.div(600) (#533)
-_lastRebasedTime = _lastRebasedTime.add(times.mul(600)) (#553)
RebaseAPY.takeFee(address,address,uint256) (#642-679) performs a multiplication on the result of a division:
-feeAmount = gonAmount.div(feeDenominator).mul(_totalFee) (#665)
RebaseAPY.takeFee(address,address,uint256) (#642-679) performs a multiplication on the result of a division:
-_gonBalances[burnHole] = _gonBalances[burnHole].add(gonAmount.div(feeDenominator).mul(burnHoleFee)) (#667-669)
RebaseAPY.takeFee(address,address,uint256) (#642-679) performs a multiplication on the result of a division:
-_gonBalances[address(this)] = _gonBalances[address(this)].add(gonAmount.div(feeDenominator).mul(_treasuryFee.add(rebaseapyInsuranceFundFee))) (#670-672)
RebaseAPY.takeFee(address,address,uint256) (#642-679) performs a multiplication on the result of a division:
-_gonBalances[autoLiquidityReceiver] = _gonBalances[autoLiquidityReceiver].add(gonAmount.div(feeDenominator).mul(liquidityFee)) (#673-675)
RebaseAPY.getLiquidityBacking(uint256) (#921-929) performs a multiplication on the result of a division:
-liquidityBalance = _gonBalances[pair].div(_gonsPerFragment) (#926)
-accuracy.mul(liquidityBalance.mul(2)).div(getCirculatingSupply()) (#927-928)
Consider ordering multiplication before division.

Additional information: link

RebaseAPY.addLiquidity() (#681-723) ignores return value by router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
Ensure that all the return values of the function calls are used.

Additional information: link

RebaseAPY.setFeeReceivers(address,address,address,address)._autoLiquidityReceiver (#910) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#915)
RebaseAPY.setFeeReceivers(address,address,address,address)._treasuryReceiver (#911) lacks a zero-check on :
- treasuryReceiver = _treasuryReceiver (#916)
RebaseAPY.setFeeReceivers(address,address,address,address)._rebaseapyInsuranceFundReceiver (#912) lacks a zero-check on :
- rebaseapyInsuranceFundReceiver = _rebaseapyInsuranceFundReceiver (#917)
RebaseAPY.setFeeReceivers(address,address,address,address)._burnHole (#913) lacks a zero-check on :
- burnHole = _burnHole (#918)
RebaseAPY.setPairAddress(address)._pairAddress (#940) lacks a zero-check on :
- pairAddress = _pairAddress (#941)
Check that the address is not zero.

Additional information: link

Reentrancy in RebaseAPY.addLiquidity() (#681-723):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#702-708)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
External calls sending eth:
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
State variables written after the call(s):
- _lastAddLiquidityTime = block.timestamp (#722)
Reentrancy in RebaseAPY.constructor() (#481-525):
External calls:
- pinkAntiBot.setTokenOwner(msg.sender) (#488)
State variables written after the call(s):
- antiBotEnabled = true (#489)
- router = IPancakeSwapRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E) (#498)
Reentrancy in RebaseAPY.constructor() (#481-525):
External calls:
- pinkAntiBot.setTokenOwner(msg.sender) (#488)
- pair = IPancakeSwapFactory(router.factory()).createPair(router.WETH(),address(this)) (#499-502)
State variables written after the call(s):
- _allowedFragments[address(this)][address(router)] = type()(uint256).max (#509)
- _autoAddLiquidity = true (#519)
- _autoRebase = true (#518)
- _gonBalances[treasuryReceiver] = TOTAL_GONS (#514)
- _gonsPerFragment = TOTAL_GONS.div(_totalSupply) (#515)
- _initRebaseStartTime = block.timestamp (#516)
- _isFeeExempt[treasuryReceiver] = true (#520)
- _isFeeExempt[address(this)] = true (#521)
- _lastRebasedTime = block.timestamp (#517)
- _transferOwnership(treasuryReceiver) (#523)
- _owner = newOwner (#372)
- _totalSupply = INITIAL_FRAGMENTS_SUPPLY (#513)
- autoLiquidityReceiver = 0xE5cB6dF681A1dd31Cf8175b97d7473DBd1a85B1d (#504)
- burnHole = 0x1033B764fe69Eb1eA107cF0b00429F87F86E86D1 (#507)
- pair = IPancakeSwapFactory(router.factory()).createPair(router.WETH(),address(this)) (#499-502)
- pairAddress = pair (#510)
- pairContract = IPancakeSwapPair(pair) (#511)
- rebaseapyInsuranceFundReceiver = 0x67B586d7E287487c8386103630444d473475ad2b (#506)
- treasuryReceiver = 0xf8CE07f188b0575F7062014dc228963858122050 (#505)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in RebaseAPY._transferFrom(address,address,uint256) (#599-640):
External calls:
- rebase() (#613)
- pairContract.sync() (#555)
- addLiquidity() (#617)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#702-708)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
- swapBack() (#621)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#739-745)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
External calls sending eth:
- addLiquidity() (#617)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#713-720)
- swapBack() (#621)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount.div(_gonsPerFragment)) (#677)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#626-628)
- Transfer(sender,recipient,gonAmountReceived.div(_gonsPerFragment)) (#634-638)
Reentrancy in RebaseAPY.constructor() (#481-525):
External calls:
- pinkAntiBot.setTokenOwner(msg.sender) (#488)
- pair = IPancakeSwapFactory(router.factory()).createPair(router.WETH(),address(this)) (#499-502)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#371)
- _transferOwnership(treasuryReceiver) (#523)
- Transfer(address(0x0),treasuryReceiver,_totalSupply) (#524)
Reentrancy in RebaseAPY.rebase() (#527-558):
External calls:
- pairContract.sync() (#555)
Event emitted after the call(s):
- LogRebase(epoch,_totalSupply) (#557)
Apply the check-effects-interactions pattern.

Additional information: link

RebaseAPY.isContract(address) (#956-960) uses assembly
- INLINE ASM (#958)
Do not use evm assembly.

Additional information: link

SafeMath.mod(uint256,uint256) (#89-92) is never used and should be removed
SafeMathInt.abs(int256) (#34-37) is never used and should be removed
SafeMathInt.add(int256,int256) (#28-32) is never used and should be removed
SafeMathInt.div(int256,int256) (#16-20) is never used and should be removed
SafeMathInt.mul(int256,int256) (#8-14) is never used and should be removed
SafeMathInt.sub(int256,int256) (#22-26) is never used and should be removed
Remove unused functions.

Additional information: link

RebaseAPY.totalFee (#440-443) is set pre-construction with a non-constant function or state variable:
- liquidityFee.add(treasuryFee).add(rebaseapyInsuranceFundFee).add(burnHoleFee)
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version^0.8.12 (#2) necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.7
solc-0.8.12 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in RebaseAPY.swapBack() (#725-763):
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#751-756)
- (success,None) = address(rebaseapyInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(rebaseapyInsuranceFundFee).div(treasuryFee.add(rebaseapyInsuranceFundFee))}() (#757-762)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

owner() should be declared external:
- Ownable.owner() (#347-349)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#360-363)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#365-367)
name() should be declared external:
- ERC20Detailed.name() (#391-393)
symbol() should be declared external:
- ERC20Detailed.symbol() (#395-397)
decimals() should be declared external:
- ERC20Detailed.decimals() (#399-401)
getLiquidityBacking(uint256) should be declared external:
- RebaseAPY.getLiquidityBacking(uint256) (#921-929)
setPairAddress(address) should be declared external:
- RebaseAPY.setPairAddress(address) (#940-942)
Use the external attribute for functions never called from the contract.

Additional information: link

Contract has 6% buy tax and 8% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Token is deployed only at one blockchain

Token has only one trading pair

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find token on CoinHunt

Additional information: link

Token is not listed at Mobula.Finance

Additional information: link

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Token has relatively low CoinGecko rank

Token has relatively low CoinMarketCap rank