SAFUU Token

Safuu.swapBack() (#683-721) sends eth to arbitrary user
Dangerous calls:
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in Safuu._transferFrom(address,address,uint256) (#569-608):
External calls:
- rebase() (#581)
- pairContract.sync() (#528)
- addLiquidity() (#585)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
- swapBack() (#589)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#697-703)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
External calls sending eth:
- addLiquidity() (#585)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
- swapBack() (#589)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
State variables written after the call(s):
- _gonBalances[sender] = _gonBalances[sender].sub(gonAmount) (#593)
- _gonBalances[recipient] = _gonBalances[recipient].add(gonAmountReceived) (#597-599)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#594-596)
- _gonBalances[firePit] = _gonBalances[firePit].add(gonAmount.div(feeDenominator).mul(firePitFee)) (#625-627)
- _gonBalances[address(this)] = _gonBalances[address(this)].add(gonAmount.div(feeDenominator).mul(_treasuryFee.add(safuuInsuranceFundFee))) (#628-630)
- _gonBalances[autoLiquidityReceiver] = _gonBalances[autoLiquidityReceiver].add(gonAmount.div(feeDenominator).mul(liquidityFee)) (#631-633)
- swapBack() (#589)
- inSwap = true (#447)
- inSwap = false (#449)
Apply the check-effects-interactions pattern.

Additional information: link

Too many vulnerabilities (Unchecked transfer, Reentrancy vulnerability, etc.). High risk of a scam. DYOR & manual audit are advised.

Safuu._decimals (#406) shadows:
- ERC20Detailed._decimals (#372)
Safuu._symbol (#405) shadows:
- ERC20Detailed._symbol (#371)
Safuu._name (#404) shadows:
- ERC20Detailed._name (#370)
Remove the state variable shadowing.

Additional information: link

Contract ownership is not renounced (belongs to a wallet)

Safuu.swapBack().success (#709) is written in both
(success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
(success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
Fix or remove the writes.

Additional information: link

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

SafeMathInt.div(int256,int256) (#19-23) is never used and should be removed
SafeMathInt.abs(int256) (#37-40) is never used and should be removed
SafeMathInt.mul(int256,int256) (#11-17) is never used and should be removed
SafeMathInt.sub(int256,int256) (#25-29) is never used and should be removed
SafeMath.mod(uint256,uint256) (#92-95) is never used and should be removed
SafeMathInt.add(int256,int256) (#31-35) is never used and should be removed
Remove unused functions.

Additional information: link

Pragma version^0.7.4 (#5) allows old versions
solc-0.7.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.

Safuu.rebase().rebaseRate (#503) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

Safuu.addLiquidity() (#639-681) ignores return value by router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
Ensure that all the return values of the function calls are used.

Additional information: link

Safuu.isContract(address) (#910-914) uses assembly
- INLINE ASM (#912)
Do not use evm assembly.

Additional information: link

Safuu.DEAD (#434) should be constant
Safuu.swapEnabled (#442) should be constant
Safuu.safuuInsuranceFundFee (#425) should be constant
Safuu.feeDenominator (#432) should be constant
Safuu._name (#404) should be constant
Safuu.sellFee (#426) should be constant
Safuu.treasuryFee (#424) should be constant
Safuu._decimals (#406) should be constant
Safuu.ZERO (#435) should be constant
Safuu.liquidityFee (#423) should be constant
Safuu._symbol (#405) should be constant
Safuu.firePitFee (#427) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

Safuu.setFeeReceivers(address,address,address,address)._autoLiquidityReceiver (#864) lacks a zero-check on :
- autoLiquidityReceiver = _autoLiquidityReceiver (#869)
Safuu.setFeeReceivers(address,address,address,address)._safuuInsuranceFundReceiver (#866) lacks a zero-check on :
- safuuInsuranceFundReceiver = _safuuInsuranceFundReceiver (#871)
Safuu.setPairAddress(address)._pairAddress (#894) lacks a zero-check on :
- pairAddress = _pairAddress (#895)
Safuu.setFeeReceivers(address,address,address,address)._treasuryReceiver (#865) lacks a zero-check on :
- treasuryReceiver = _treasuryReceiver (#870)
Safuu.setFeeReceivers(address,address,address,address)._firePit (#867) lacks a zero-check on :
- firePit = _firePit (#872)
Check that the address is not zero.

Additional information: link

Safuu.slitherConstructorVariables() (#397-918) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#434)
Safuu.slitherConstructorVariables() (#397-918) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#435)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

Reentrancy in Safuu.addLiquidity() (#639-681):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
External calls sending eth:
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
State variables written after the call(s):
- _lastAddLiquidityTime = block.timestamp (#680)
Apply the check-effects-interactions pattern.

Additional information: link

Safuu.takeFee(address,address,uint256) (#610-637) performs a multiplication on the result of a division:
-_gonBalances[address(this)] = _gonBalances[address(this)].add(gonAmount.div(feeDenominator).mul(_treasuryFee.add(safuuInsuranceFundFee))) (#628-630)
Safuu.rebase() (#500-531) performs a multiplication on the result of a division:
-times = deltaTime.div(900) (#506)
-_lastRebasedTime = _lastRebasedTime.add(times.mul(900)) (#526)
Safuu.takeFee(address,address,uint256) (#610-637) performs a multiplication on the result of a division:
-_gonBalances[firePit] = _gonBalances[firePit].add(gonAmount.div(feeDenominator).mul(firePitFee)) (#625-627)
Safuu.rebase() (#500-531) performs a multiplication on the result of a division:
-times = deltaTime.div(900) (#506)
-epoch = times.mul(15) (#507)
Safuu.getLiquidityBacking(uint256) (#875-883) performs a multiplication on the result of a division:
-liquidityBalance = _gonBalances[pair].div(_gonsPerFragment) (#880)
-accuracy.mul(liquidityBalance.mul(2)).div(getCirculatingSupply()) (#881-882)
Safuu.takeFee(address,address,uint256) (#610-637) performs a multiplication on the result of a division:
-feeAmount = gonAmount.div(feeDenominator).mul(_totalFee) (#623)
Safuu.takeFee(address,address,uint256) (#610-637) performs a multiplication on the result of a division:
-_gonBalances[autoLiquidityReceiver] = _gonBalances[autoLiquidityReceiver].add(gonAmount.div(feeDenominator).mul(liquidityFee)) (#631-633)
Consider ordering multiplication before division.

Additional information: link

Reentrancy in Safuu.rebase() (#500-531):
External calls:
- pairContract.sync() (#528)
Event emitted after the call(s):
- LogRebase(epoch,_totalSupply) (#530)
Reentrancy in Safuu._transferFrom(address,address,uint256) (#569-608):
External calls:
- rebase() (#581)
- pairContract.sync() (#528)
- addLiquidity() (#585)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#660-666)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
- swapBack() (#589)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#697-703)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
External calls sending eth:
- addLiquidity() (#585)
- router.addLiquidityETH{value: amountETHLiquidity}(address(this),amountToLiquify,0,0,autoLiquidityReceiver,block.timestamp) (#671-678)
- swapBack() (#589)
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount.div(_gonsPerFragment)) (#635)
- gonAmountReceived = takeFee(sender,recipient,gonAmount) (#594-596)
- Transfer(sender,recipient,gonAmountReceived.div(_gonsPerFragment)) (#602-606)
Apply the check-effects-interactions pattern.

Additional information: link

Safuu.shouldAddLiquidity() (#758-764) uses timestamp for comparisons
Dangerous comparisons:
- _autoAddLiquidity && ! inSwap && msg.sender != pair && block.timestamp >= (_lastAddLiquidityTime + 172800) (#759-763)
Safuu.shouldRebase() (#749-756) uses timestamp for comparisons
Dangerous comparisons:
- _autoRebase && (_totalSupply < MAX_SUPPLY) && msg.sender != pair && ! inSwap && block.timestamp >= (_lastRebasedTime + 900) (#750-755)
Safuu.rebase() (#500-531) uses timestamp for comparisons
Dangerous comparisons:
- deltaTimeFromInit < (31536000) (#509)
- deltaTimeFromInit >= (31536000) (#511)
- deltaTimeFromInit >= ((15 * 31536000) / 10) (#513)
- deltaTimeFromInit >= (7 * 31536000) (#515)
- i < times (#519)
Avoid relying on block.timestamp.

Additional information: link

Safuu.totalFee (#428-431) is set pre-construction with a non-constant function or state variable:
- liquidityFee.add(treasuryFee).add(safuuInsuranceFundFee).add(firePitFee)
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Low level call in Safuu.swapBack() (#683-721):
- (success) = address(treasuryReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(treasuryFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#709-714)
- (success,None) = address(safuuInsuranceFundReceiver).call{gas: 30000,value: amountETHToTreasuryAndSIF.mul(safuuInsuranceFundFee).div(treasuryFee.add(safuuInsuranceFundFee))}() (#715-720)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Variable Safuu._symbol (#405) is not in mixedCase
Parameter Safuu.setAutoAddLiquidity(bool)._flag (#781) is not in mixedCase
Parameter Safuu.setAutoRebase(bool)._flag (#772) is not in mixedCase
Variable Safuu._name (#404) is not in mixedCase
Variable Safuu._initRebaseStartTime (#459) is not in mixedCase
Parameter Safuu.setFeeReceivers(address,address,address,address)._safuuInsuranceFundReceiver (#866) is not in mixedCase
Parameter Safuu.setFeeReceivers(address,address,address,address)._firePit (#867) is not in mixedCase
Parameter Safuu.setPairAddress(address)._pairAddress (#894) is not in mixedCase
Function IPancakeSwapPair.PERMIT_TYPEHASH() (#143) is not in mixedCase
Parameter Safuu.setFeeReceivers(address,address,address,address)._autoLiquidityReceiver (#864) is not in mixedCase
Parameter Safuu.setFeeReceivers(address,address,address,address)._treasuryReceiver (#865) is not in mixedCase
Variable Safuu._lastRebasedTime (#460) is not in mixedCase
Variable Safuu._lastAddLiquidityTime (#461) is not in mixedCase
Function IPancakeSwapRouter.WETH() (#180) is not in mixedCase
Variable Safuu._autoRebase (#457) is not in mixedCase
Parameter Safuu.setBotBlacklist(address,bool)._botAddress (#889) is not in mixedCase
Variable Safuu._isFeeExempt (#409) is not in mixedCase
Function IPancakeSwapPair.DOMAIN_SEPARATOR() (#142) is not in mixedCase
Function IPancakeSwapPair.MINIMUM_LIQUIDITY() (#160) is not in mixedCase
Variable Safuu._decimals (#406) is not in mixedCase
Parameter Safuu.checkFeeExempt(address)._addr (#844) is not in mixedCase
Variable Safuu._totalSupply (#462) is not in mixedCase
Variable Safuu.ZERO (#435) is not in mixedCase
Parameter Safuu.setBotBlacklist(address,bool)._flag (#889) is not in mixedCase
Parameter Safuu.setWhitelist(address)._addr (#885) is not in mixedCase
Parameter Safuu.setLP(address)._address (#898) is not in mixedCase
Variable Safuu.DEAD (#434) is not in mixedCase
Variable Safuu._autoAddLiquidity (#458) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#185) is too similar to IPancakeSwapRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#186)
Prevent variables from having similar names.

Additional information: link

SafeMathInt.MAX_INT256 (#9) is never used in SafeMathInt (#7-41)
Remove unused state variables.

Additional information: link

decimals() should be declared external:
- ERC20Detailed.decimals() (#392-394)
symbol() should be declared external:
- ERC20Detailed.symbol() (#388-390)
name() should be declared external:
- ERC20Detailed.name() (#384-386)
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#353-356)
setPairAddress(address) should be declared external:
- Safuu.setPairAddress(address) (#894-896)
owner() should be declared external:
- Ownable.owner() (#340-342)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#358-360)
getLiquidityBacking(uint256) should be declared external:
- Safuu.getLiquidityBacking(uint256) (#875-883)
Use the external attribute for functions never called from the contract.

Additional information: link

Contract has 14% buy tax and 16% sell tax.
Taxes are suspiciously high (over 10%) and contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Token is deployed only at one blockchain

Unable to find Telegram link on the website

Unable to find token on CoinHunt

Additional information: link

Token is marked as scam (rug pull, honeypot, phishing, etc.)

Additional information: link

Young tokens have high risks of price dump / death