STCK [Stack Coin] Token

ERC1967UpgradeUpgradeable._functionDelegateCall(address,bytes) (#641-647) uses delegatecall to a input-controlled function id
- (success,returndata) = target.delegatecall(data) (#645)
Avoid using delegatecall. Use only trusted destinations.

Additional information: link

UUPSUpgradeable.__gap (#742) shadows:
- ERC1967UpgradeUpgradeable.__gap (#654)
AccessControlUpgradeable.__gap (#960) shadows:
- ERC165Upgradeable.__gap (#758)
- ContextUpgradeable.__gap (#775)
PausableUpgradeable.__gap (#1042) shadows:
- ContextUpgradeable.__gap (#775)
ERC20Upgradeable.__gap (#1224) shadows:
- ContextUpgradeable.__gap (#775)
Remove the state variable shadowing.

Additional information: link

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

StackCoin (#1227-1387) is an upgradeable contract that does not protect its initiliaze functions: StackCoin.initialize() (#1241-1255). Anyone can delete the contract with: UUPSUpgradeable.upgradeTo(address) (#707-710)UUPSUpgradeable.upgradeToAndCall(address,bytes) (#720-723)
Add a constructor to ensure initialize cannot be called on the logic contract.

Additional information: link

StorageSlotUpgradeable.getAddressSlot(bytes32) (#25-29) uses assembly
- INLINE ASM (#26-28)
StorageSlotUpgradeable.getBooleanSlot(bytes32) (#34-38) uses assembly
- INLINE ASM (#35-37)
StorageSlotUpgradeable.getBytes32Slot(bytes32) (#43-47) uses assembly
- INLINE ASM (#44-46)
StorageSlotUpgradeable.getUint256Slot(bytes32) (#52-56) uses assembly
- INLINE ASM (#53-55)
AddressUpgradeable.isContract(address) (#251-261) uses assembly
- INLINE ASM (#257-259)
AddressUpgradeable.verifyCallResult(bool,bytes,string) (#393-413) uses assembly
- INLINE ASM (#405-408)
Do not use evm assembly.

Additional information: link

ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool).slot (#541) is a local variable never initialized
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.

Additional information: link

ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool) (#530-548) ignores return value by IERC1822ProxiableUpgradeable(newImplementation).proxiableUUID() (#541-545)
Ensure that all the return values of the function calls are used.

Additional information: link

Variable 'ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool).slot (#541)' in ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool) (#530-548) potentially used before declaration: require(bool,string)(slot == _IMPLEMENTATION_SLOT,ERC1967Upgrade: unsupported proxiableUUID) (#542)
Move all variable declarations prior to any usage of the variable, and ensure that reaching a variable declaration does not depend on some conditional if it is used unconditionally.

Additional information: link

AccessControlUpgradeable._setRoleAdmin(bytes32,bytes32) (#931-935) is never used and should be removed
AddressUpgradeable.functionCall(address,bytes) (#304-306) is never used and should be removed
AddressUpgradeable.functionCall(address,bytes,string) (#314-320) is never used and should be removed
AddressUpgradeable.functionCallWithValue(address,bytes,uint256) (#333-339) is never used and should be removed
AddressUpgradeable.functionCallWithValue(address,bytes,uint256,string) (#347-358) is never used and should be removed
AddressUpgradeable.functionStaticCall(address,bytes) (#366-368) is never used and should be removed
AddressUpgradeable.functionStaticCall(address,bytes,string) (#376-385) is never used and should be removed
AddressUpgradeable.sendValue(address,uint256) (#279-284) is never used and should be removed
ContextUpgradeable.__Context_init() (#762-764) is never used and should be removed
ContextUpgradeable._msgData() (#772-774) is never used and should be removed
ERC165Upgradeable.__ERC165_init() (#746-748) is never used and should be removed
ERC1967UpgradeUpgradeable.__ERC1967Upgrade_init() (#464-465) is never used and should be removed
ERC1967UpgradeUpgradeable.__ERC1967Upgrade_init_unchained() (#467-468) is never used and should be removed
ERC1967UpgradeUpgradeable._changeAdmin(address) (#582-585) is never used and should be removed
ERC1967UpgradeUpgradeable._getAdmin() (#565-567) is never used and should be removed
ERC1967UpgradeUpgradeable._getBeacon() (#601-603) is never used and should be removed
ERC1967UpgradeUpgradeable._setAdmin(address) (#572-575) is never used and should be removed
ERC1967UpgradeUpgradeable._setBeacon(address) (#608-615) is never used and should be removed
ERC1967UpgradeUpgradeable._upgradeBeaconToAndCall(address,bytes,bool) (#623-633) is never used and should be removed
StackCoin._burn(address,uint256) (#1323-1334) is never used and should be removed
StorageSlotUpgradeable.getBytes32Slot(bytes32) (#43-47) is never used and should be removed
StorageSlotUpgradeable.getUint256Slot(bytes32) (#52-56) is never used and should be removed
StringsUpgradeable.toHexString(uint256) (#123-134) is never used and should be removed
StringsUpgradeable.toString(uint256) (#98-118) is never used and should be removed
UUPSUpgradeable.__UUPSUpgradeable_init_unchained() (#661-662) is never used and should be removed
UUPSUpgradeable._authorizeUpgrade(address) (#735) is never used and should be removed
Remove unused functions.

Additional information: link

Pragma version^0.8.0 (#3) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in AddressUpgradeable.sendValue(address,uint256) (#279-284):
- (success) = recipient.call{value: amount}() (#282)
Low level call in AddressUpgradeable.functionCallWithValue(address,bytes,uint256,string) (#347-358):
- (success,returndata) = target.call{value: value}(data) (#356)
Low level call in AddressUpgradeable.functionStaticCall(address,bytes,string) (#376-385):
- (success,returndata) = target.staticcall(data) (#383)
Low level call in ERC1967UpgradeUpgradeable._functionDelegateCall(address,bytes) (#641-647):
- (success,returndata) = target.delegatecall(data) (#645)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Function ERC1967UpgradeUpgradeable.__ERC1967Upgrade_init() (#464-465) is not in mixedCase
Function ERC1967UpgradeUpgradeable.__ERC1967Upgrade_init_unchained() (#467-468) is not in mixedCase
Variable ERC1967UpgradeUpgradeable.__gap (#654) is not in mixedCase
Function UUPSUpgradeable.__UUPSUpgradeable_init() (#658-659) is not in mixedCase
Function UUPSUpgradeable.__UUPSUpgradeable_init_unchained() (#661-662) is not in mixedCase
Variable UUPSUpgradeable.__gap (#742) is not in mixedCase
Variable UUPSUpgradeable.__self (#664) is not in mixedCase
Function ERC165Upgradeable.__ERC165_init() (#746-748) is not in mixedCase
Function ERC165Upgradeable.__ERC165_init_unchained() (#750-751) is not in mixedCase
Variable ERC165Upgradeable.__gap (#758) is not in mixedCase
Function ContextUpgradeable.__Context_init() (#762-764) is not in mixedCase
Function ContextUpgradeable.__Context_init_unchained() (#766-767) is not in mixedCase
Variable ContextUpgradeable.__gap (#775) is not in mixedCase
Function AccessControlUpgradeable.__AccessControl_init() (#779-783) is not in mixedCase
Function AccessControlUpgradeable.__AccessControl_init_unchained() (#785-786) is not in mixedCase
Variable AccessControlUpgradeable.__gap (#960) is not in mixedCase
Function PausableUpgradeable.__Pausable_init() (#979-982) is not in mixedCase
Function PausableUpgradeable.__Pausable_init_unchained() (#984-986) is not in mixedCase
Variable PausableUpgradeable.__gap (#1042) is not in mixedCase
Function ERC20Upgradeable.__ERC20_init(string,string) (#1144-1146) is not in mixedCase
Function ERC20Upgradeable.__ERC20_init_unchained(string,string) (#1148-1151) is not in mixedCase
Variable ERC20Upgradeable.__gap (#1224) is not in mixedCase
Function StackCoin.BlacklistAddress(address) (#1353-1355) is not in mixedCase
Function StackCoin.UnBlacklistAddress(address) (#1357-1359) is not in mixedCase
Parameter StackCoin.setFeeExempt(address)._addr (#1361) is not in mixedCase
Parameter StackCoin.setFee(uint256)._val (#1365) is not in mixedCase
Parameter StackCoin.updateFee(bool)._flag (#1369) is not in mixedCase
Variable StackCoin.Blacklist (#1237) is not in mixedCase
Variable StackCoin._isFeeExempt (#1238) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

UUPSUpgradeable.__gap (#742) is never used in StackCoin (#1227-1387)
Remove unused state variables.

Additional information: link

grantRole(bytes32,address) should be declared external:
- AccessControlUpgradeable.grantRole(bytes32,address) (#867-869)
revokeRole(bytes32,address) should be declared external:
- AccessControlUpgradeable.revokeRole(bytes32,address) (#880-882)
renounceRole(bytes32,address) should be declared external:
- AccessControlUpgradeable.renounceRole(bytes32,address) (#898-902)
name() should be declared external:
- ERC20Upgradeable.name() (#1156-1158)
symbol() should be declared external:
- ERC20Upgradeable.symbol() (#1164-1166)
decimals() should be declared external:
- ERC20Upgradeable.decimals() (#1168-1170)
approve(address,uint256) should be declared external:
- ERC20Upgradeable.approve(address,uint256) (#1176-1180)
increaseAllowance(address,uint256) should be declared external:
- ERC20Upgradeable.increaseAllowance(address,uint256) (#1181-1185)
decreaseAllowance(address,uint256) should be declared external:
- ERC20Upgradeable.decreaseAllowance(address,uint256) (#1187-1196)
initialize() should be declared external:
- StackCoin.initialize() (#1241-1255)
totalSupply() should be declared external:
- StackCoin.totalSupply() (#1257-1259)
transfer(address,uint256) should be declared external:
- StackCoin.transfer(address,uint256) (#1261-1265)
transferFrom(address,address,uint256) should be declared external:
- StackCoin.transferFrom(address,address,uint256) (#1267-1276)
pause() should be declared external:
- StackCoin.pause() (#1336-1338)
balanceOf(address) should be declared external:
- StackCoin.balanceOf(address) (#1340-1342)
unpause() should be declared external:
- StackCoin.unpause() (#1345-1347)
mint(address,uint256) should be declared external:
- StackCoin.mint(address,uint256) (#1349-1351)
BlacklistAddress(address) should be declared external:
- StackCoin.BlacklistAddress(address) (#1353-1355)
UnBlacklistAddress(address) should be declared external:
- StackCoin.UnBlacklistAddress(address) (#1357-1359)
rescueToken(address,uint256) should be declared external:
- StackCoin.rescueToken(address,uint256) (#1373-1379)
Use the external attribute for functions never called from the contract.

Additional information: link

Average 30d PancakeSwap volume is less than $100. Token is either dead or inactive.

Average 30d number of PancakeSwap swaps is less than 1. Token is either dead or inactive.

Average PancakeSwap trading volume, liqudity, number of swaps are extremely low. Token seems to be dead.

Token is deployed only at one blockchain

Token has only one trading pair

Average 30d PancakeSwap liquidity is low.

Number of Binance Smart Chain (BSC) token holders is low.

Unable to find website, listings and other project-related information

Young tokens have high risks of scam / price dump / death

Token has no active CoinGecko listing / rank

Token has no active CoinMarketCap listing / rank