SQUID2 [Squid Game 2.0] Token

SquidGameTwo.addLiquidity(uint256,uint256) (#433-443) sends eth to arbitrary user
Dangerous calls:
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in SquidGameTwo._transfer(address,address,uint256) (#455-541):
External calls:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
- (success2) = address(teamAddress).call{value: teamTokens}() (#517)
External calls sending eth:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
- (success2) = address(teamAddress).call{value: teamTokens}() (#517)
State variables written after the call(s):
- super._transfer(from,address(this),txFees) (#528)
- _balances[sender] = senderBalance - amount (#160)
- _balances[recipient] += amount (#161)
- super._transfer(from,address(this),txFees_scope_0) (#534)
- _balances[sender] = senderBalance - amount (#160)
- _balances[recipient] += amount (#161)
- super._transfer(from,to,amount) (#540)
- _balances[sender] = senderBalance - amount (#160)
- _balances[recipient] += amount (#161)
Apply the check-effects-interactions pattern.

Additional information: link

Contract ownership is not renounced (belongs to a wallet)

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Variable ERC20._totalSupply (#104) is too similar to SquidGameTwo.constructor().total_supply (#262)
Prevent variables from having similar names.

Additional information: link

Contract name (Squid Game 2.0) contains non-alphanumeric characters.
Not a direct threat, but may indicate unreliable intentions of developer. Non-alphanumeric chars (,.;!#*&") are extremely rare among low risk tokens.

SquidGameTwo.addLiquidity(uint256,uint256) (#433-443) ignores return value by pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
Ensure that all the return values of the function calls are used.

Additional information: link

SquidGameTwo.updatePancakeV2Router(address,bool,address)._pancakeV2Pair (#288-289) lacks a zero-check on :
- pancakeV2Pair = _pancakeV2Pair (#290)
SquidGameTwo.updatePancakeV2Router(address,bool,address)._pair (#285) lacks a zero-check on :
- pancakeV2Pair = _pair (#293)
SquidGameTwo.setFeesAddress(address,address,address,address).marketing (#336) lacks a zero-check on :
- marketingAddress = marketing (#337)
SquidGameTwo.setFeesAddress(address,address,address,address).liquidity (#336) lacks a zero-check on :
- liquidityAddress = liquidity (#338)
SquidGameTwo.setFeesAddress(address,address,address,address).team (#336) lacks a zero-check on :
- teamAddress = team (#339)
SquidGameTwo.setFeesAddress(address,address,address,address).dev (#336) lacks a zero-check on :
- devAddress = dev (#340)
Check that the address is not zero.

Additional information: link

Reentrancy in SquidGameTwo.constructor() (#261-281):
External calls:
- pancakeV2Pair = IPancakeV2Factory(_pancakeV2Router.factory()).createPair(address(this),_pancakeV2Router.WETH()) (#269-270)
State variables written after the call(s):
- _mint(owner(),total_supply) (#280)
- _balances[account] += amount (#168)
- _mint(owner(),total_supply) (#280)
- _totalSupply += amount (#167)
- automatedMarketMakerPairs[pancakeV2Pair] = true (#279)
- excludedFromFees[address(this)] = true (#272)
- excludedFromFees[owner()] = true (#273)
- excludedFromFees[liquidityAddress] = true (#274)
- excludedFromFees[marketingAddress] = true (#275)
- excludedFromFees[teamAddress] = true (#276)
- excludedFromFees[devAddress] = true (#277)
- premarketUser[owner()] = true (#278)
Reentrancy in SquidGameTwo.swapTokens(uint256) (#444-454):
External calls:
- swapTokensForEth(swaptokensamount) (#448)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- addLiquidity(liq_part,liq_part_percent) (#452)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
External calls sending eth:
- addLiquidity(liq_part,liq_part_percent) (#452)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
State variables written after the call(s):
- addLiquidity(liq_part,liq_part_percent) (#452)
- _allowances[owner][spender] = amount (#183)
Reentrancy in SquidGameTwo.updatePancakeV2Router(address,bool,address) (#285-296):
External calls:
- _pancakeV2Pair = IPancakeV2Factory(pancakeV2Router.factory()).createPair(address(this),pancakeV2Router.WETH()) (#288-289)
State variables written after the call(s):
- pancakeV2Pair = _pancakeV2Pair (#290)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in SquidGameTwo._transfer(address,address,uint256) (#455-541):
External calls:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
External calls sending eth:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
Event emitted after the call(s):
- MarketingFeeCollected(marketingTokens) (#509)
Reentrancy in SquidGameTwo._transfer(address,address,uint256) (#455-541):
External calls:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
External calls sending eth:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
Event emitted after the call(s):
- DevFeeCollected(devTokens) (#514)
Reentrancy in SquidGameTwo._transfer(address,address,uint256) (#455-541):
External calls:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
- (success2) = address(teamAddress).call{value: teamTokens}() (#517)
External calls sending eth:
- swapTokens(tokensToSwap) (#491)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
- (success2) = address(teamAddress).call{value: teamTokens}() (#517)
Event emitted after the call(s):
- TeamFeeCollected(marketingTokens) (#519)
- Transfer(sender,recipient,amount) (#162)
- super._transfer(from,to,amount) (#540)
- Transfer(sender,recipient,amount) (#162)
- super._transfer(from,address(this),txFees) (#528)
- Transfer(sender,recipient,amount) (#162)
- super._transfer(from,address(this),txFees_scope_0) (#534)
Reentrancy in SquidGameTwo.constructor() (#261-281):
External calls:
- pancakeV2Pair = IPancakeV2Factory(_pancakeV2Router.factory()).createPair(address(this),_pancakeV2Router.WETH()) (#269-270)
Event emitted after the call(s):
- Transfer(address(0),account,amount) (#169)
- _mint(owner(),total_supply) (#280)
Reentrancy in SquidGameTwo.swapTokens(uint256) (#444-454):
External calls:
- swapTokensForEth(swaptokensamount) (#448)
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
- addLiquidity(liq_part,liq_part_percent) (#452)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
External calls sending eth:
- addLiquidity(liq_part,liq_part_percent) (#452)
- pancakeV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityAddress,block.timestamp) (#435-442)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#184)
- addLiquidity(liq_part,liq_part_percent) (#452)
Reentrancy in SquidGameTwo.swapTokensForEth(uint256) (#413-426):
External calls:
- pancakeV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#418-424)
Event emitted after the call(s):
- ContractSwap(block.timestamp,tokenAmount) (#425)
Reentrancy in SquidGameTwo.transferToken(address,address,uint256) (#298-304):
External calls:
- _sent = IERC20(_token).transfer(_to,_value) (#302)
Event emitted after the call(s):
- TokenRemovedFromContract(_token,_value) (#303)
Reentrancy in SquidGameTwo.updatePancakeV2Router(address,bool,address) (#285-296):
External calls:
- _pancakeV2Pair = IPancakeV2Factory(pancakeV2Router.factory()).createPair(address(this),pancakeV2Router.WETH()) (#288-289)
Event emitted after the call(s):
- PancakePairUpdated(newAddress,pancakeV2Pair) (#291)
- PancakeRouterUpdated(newAddress,pancakeV2Pair) (#295)
Apply the check-effects-interactions pattern.

Additional information: link

SquidGameTwo._transfer(address,address,uint256) (#455-541) uses timestamp for comparisons
Dangerous comparisons:
- marketActiveAt + 30 < block.timestamp (#473)
- require(bool,string)(marketActiveAt + 7 < block.timestamp,You cannot buy at launch.) (#474)
- require(bool,string)(userLastTradeData[to].lastBuyTime + 3 <= block.timestamp,You cannot do multi-buy orders.) (#475)
- overMinimumTokenBalance && startTimeForSwap + intervalSecondsForSwap <= block.timestamp (#488)
Avoid relying on block.timestamp.

Additional information: link

Context._msgData() (#68-71) is never used and should be removed
ERC20._burn(address,uint256) (#171-179) is never used and should be removed
Remove unused functions.

Additional information: link

SquidGameTwo.totalBuyFee (#217) is set pre-construction with a non-constant function or state variable:
- buyMarketingFee + buyLiquidityFee + buyDevFee + buyTeamFee
SquidGameTwo.totalSellFee (#218) is set pre-construction with a non-constant function or state variable:
- sellMarketingFee + sellLiquidityFee + sellDevFee + sellTeamFee
SquidGameTwo.minimumTokensBeforeSwap (#221) is set pre-construction with a non-constant function or state variable:
- 50_000 * 10 ** decimals()
SquidGameTwo.tokensToSwap (#222) is set pre-construction with a non-constant function or state variable:
- 50_000 * 10 ** decimals()
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Pragma version0.8.15 (#23) necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.7
solc-0.8.15 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in SquidGameTwo._transfer(address,address,uint256) (#455-541):
- (success) = address(marketingAddress).call{value: marketingTokens}() (#507)
- (success1) = address(devAddress).call{value: devTokens}() (#512)
- (success2) = address(teamAddress).call{value: teamTokens}() (#517)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function IPancakeV2Router02.WETH() (#30) is not in mixedCase
Struct SquidGameTwo.userData (#228) is not in CapWords
Parameter SquidGameTwo.updatePancakeV2Router(address,bool,address)._createPair (#285) is not in mixedCase
Parameter SquidGameTwo.updatePancakeV2Router(address,bool,address)._pair (#285) is not in mixedCase
Parameter SquidGameTwo.transferToken(address,address,uint256)._token (#298) is not in mixedCase
Parameter SquidGameTwo.transferToken(address,address,uint256)._to (#298) is not in mixedCase
Parameter SquidGameTwo.transferToken(address,address,uint256)._value (#298) is not in mixedCase
Parameter SquidGameTwo.switchMarketActive(bool)._state (#312) is not in mixedCase
Parameter SquidGameTwo.switchLimitSells(bool)._state (#319) is not in mixedCase
Parameter SquidGameTwo.switchLimitBuys(bool)._state (#323) is not in mixedCase
Parameter SquidGameTwo.setBlockMultiBuys(bool)._status (#328) is not in mixedCase
Parameter SquidGameTwo.setminimumWeiForTokenomics(uint256)._value (#332) is not in mixedCase
Parameter SquidGameTwo.setMaxSellTxAmount(uint256)._value (#343) is not in mixedCase
Parameter SquidGameTwo.setMaxBuyTxAmount(uint256)._value (#348) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Buymarketing (#354) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Buyliquidity (#354) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Sellmarketing (#354) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Sellliquidity (#354) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Buydev (#355) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Buyteam (#355) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Selldev (#355) is not in mixedCase
Parameter SquidGameTwo.setFee(uint256,uint256,uint256,uint256,uint256,uint256,uint256,uint256).Sellteam (#355) is not in mixedCase
Parameter SquidGameTwo.setFeeStatus(bool,bool,bool)._state (#376) is not in mixedCase
Parameter SquidGameTwo.setSwapAndLiquify(bool,uint256,uint256,uint256)._state (#382) is not in mixedCase
Parameter SquidGameTwo.setSwapAndLiquify(bool,uint256,uint256,uint256)._intervalSecondsForSwap (#382) is not in mixedCase
Parameter SquidGameTwo.setSwapAndLiquify(bool,uint256,uint256,uint256)._minimumTokensBeforeSwap (#382) is not in mixedCase
Parameter SquidGameTwo.setSwapAndLiquify(bool,uint256,uint256,uint256)._tokensToSwap (#382) is not in mixedCase
Parameter SquidGameTwo.editPremarketUser(address,bool)._target (#392) is not in mixedCase
Parameter SquidGameTwo.editPremarketUser(address,bool)._status (#392) is not in mixedCase
Parameter SquidGameTwo.editExcludedFromFees(address,bool)._target (#396) is not in mixedCase
Parameter SquidGameTwo.editExcludedFromFees(address,bool)._status (#396) is not in mixedCase
Parameter SquidGameTwo.editAutomatedMarketMakerPairs(address,bool)._target (#400) is not in mixedCase
Parameter SquidGameTwo.editAutomatedMarketMakerPairs(address,bool)._status (#400) is not in mixedCase
Function SquidGameTwo.KKAirdrop(address[],uint256[]) (#405-412) is not in mixedCase
Parameter SquidGameTwo.KKAirdrop(address[],uint256[])._address (#405) is not in mixedCase
Parameter SquidGameTwo.KKAirdrop(address[],uint256[])._amount (#405) is not in mixedCase
Modifier SquidGameTwo.FastTx() (#428-432) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#69)" inContext (#64-72)
Remove redundant statements if they congest code but offer no value.

Additional information: link

Reentrancy in SquidGameTwo.transferBNB() (#306-310):
External calls:
- address(owner()).transfer(balance) (#308)
Event emitted after the call(s):
- BnbRemovedFromContract(balance) (#309)
Apply the check-effects-interactions pattern.

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#88-91)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#92-96)
getTime() should be declared external:
- Ownable.getTime() (#97-99)
name() should be declared external:
- ERC20.name() (#111-113)
symbol() should be declared external:
- ERC20.symbol() (#114-116)
transfer(address,uint256) should be declared external:
- ERC20.transfer(address,uint256) (#126-129)
allowance(address,address) should be declared external:
- ERC20.allowance(address,address) (#130-132)
approve(address,uint256) should be declared external:
- ERC20.approve(address,uint256) (#133-136)
transferFrom(address,address,uint256) should be declared external:
- ERC20.transferFrom(address,address,uint256) (#137-143)
increaseAllowance(address,uint256) should be declared external:
- ERC20.increaseAllowance(address,uint256) (#144-147)
decreaseAllowance(address,uint256) should be declared external:
- ERC20.decreaseAllowance(address,uint256) (#148-153)
Use the external attribute for functions never called from the contract.

Additional information: link

Contract has 10% buy tax and 10% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Token is deployed only at one blockchain

Token has only one trading pair

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find token on CoinGecko

Additional information: link

Token is not listed at Mobula.Finance

Additional information: link

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank