TCD [TOP Community DAO] Token

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

Contract ownership is not renounced (belongs to a wallet)

Token._transfer(address,address,uint256) (#861-936) uses a dangerous strict equality:
- shouldSetInviter = balanceOf(to) == 0 && inviter[to] == address(0) && ! isContract(from) && ! isContract(to) (#913-916)
Don't use strict equality to determine if an account has enough Ether or tokens.

Additional information: link

Contract locking ether found:
Contract Token (#501-1189) has payable functions:
- Token.receive() (#765)
But does not have a function to withdraw the ether
Remove the payable attribute or add a withdraw function.

Additional information: link

Token.isContract(address) (#655-661) uses assembly
- INLINE ASM (#657-659)
Do not use evm assembly.

Additional information: link

Redundant expression "this (#104)" inContext (#98-107)
Remove redundant statements if they congest code but offer no value.

Additional information: link

Not a direct threat, but may indicate unreliable intentions of developer. Widespread names (e.g. Elon, King, Moon, Doge) are common among meme-tokens and scams. The allow to gain free hype and attract unexperienced investors.

Token._takeMint() (#1103-1124) performs a multiplication on the result of a division:
-cycle = blockNumber.sub(lastMintBlock).div(28000) (#1108)
-amount = cycle.mul(5160 * 10 ** 18) (#1111)
Token._takeMint() (#1103-1124) performs a multiplication on the result of a division:
-cycle = blockNumber.sub(lastMintBlock).div(28000) (#1108)
-amount = cycle.mul(2580 * 10 ** 18) (#1113)
Token._takeMint() (#1103-1124) performs a multiplication on the result of a division:
-cycle = blockNumber.sub(lastMintBlock).div(28000) (#1108)
-lastMintBlock = cycle.mul(28000).add(lastMintBlock) (#1122)
Consider ordering multiplication before division.

Additional information: link

Reentrancy in Token._transfer(address,address,uint256) (#861-936):
External calls:
- swapAndLiquify(contractTokenBalance) (#888)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
State variables written after the call(s):
- _transferSwap(from,to,amount) (#924)
- _balances[burnAddress] = _balances[burnAddress].add(burnFee) (#1087)
- _balances[foundAddress] = _balances[foundAddress].add(foundFee) (#1031)
- _balances[swapPair] = _balances[swapPair].add(rewardFee) (#1099)
- _balances[address(this)] = _balances[address(this)].add(liquidityFee) (#1093)
- _balances[devAddress] = _balances[devAddress].add(devFee) (#1037)
- _balances[sender] = _balances[sender].sub(amount,ERC20: _transferSwap amount exceeds balance) (#954-957)
- _balances[recipient] = _balances[recipient].add(transferAmount) (#958)
- _balances[cur] = _balances[cur].add(inviterFee) (#1079)
- _transferStandard(from,to,amount) (#926)
- _balances[burnAddress] = _balances[burnAddress].add(burnFee) (#1087)
- _balances[sender] = _balances[sender].sub(amount,ERC20: _transferStandard amount exceeds balance) (#979-982)
- _balances[recipient] = _balances[recipient].add(transferAmount) (#983)
Apply the check-effects-interactions pattern.

Additional information: link

Token.addLiquidity(uint256,uint256) (#1171-1187) ignores return value by IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
Token.addLiquidity(uint256,uint256) (#1171-1187) ignores return value by swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
Ensure that all the return values of the function calls are used.

Additional information: link

Token.allowance(address,address).owner (#646) shadows:
- Ownable.owner() (#124-126) (function)
Token._approve(address,address,uint256).owner (#850) shadows:
- Ownable.owner() (#124-126) (function)
Rename the local variables that shadow another component.

Additional information: link

Token.setNumTokensSellToAddToLiquidity(uint256) (#726-731) should emit an event for:
- numTokensSellToAddToLiquidity = _number (#730)
Emit an event for critical parameter changes.

Additional information: link

Ownable.setOwner(address,bool).addr (#150) lacks a zero-check on :
- _owner = addr (#151)
Check that the address is not zero.

Additional information: link

Reentrancy in Token._transfer(address,address,uint256) (#861-936):
External calls:
- swapAndLiquify(contractTokenBalance) (#888)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
State variables written after the call(s):
- removeAllFee() (#919)
- _burnFee = 0 (#832)
- restoreAllFee() (#930)
- _burnFee = _previousBurnFee (#842)
- removeAllFee() (#919)
- _devFee = 0 (#834)
- restoreAllFee() (#930)
- _devFee = _previousDevFee (#844)
- removeAllFee() (#919)
- _foundFee = 0 (#833)
- restoreAllFee() (#930)
- _foundFee = _previousFoundFee (#843)
- removeAllFee() (#919)
- _inviterFee = 0 (#835)
- restoreAllFee() (#930)
- _inviterFee = _previousInviterFee (#845)
- removeAllFee() (#919)
- _liquidityFee = 0 (#830)
- restoreAllFee() (#930)
- _liquidityFee = _previousLiquidityFee (#840)
- removeAllFee() (#919)
- _previousBurnFee = _burnFee (#824)
- removeAllFee() (#919)
- _previousDevFee = _devFee (#826)
- removeAllFee() (#919)
- _previousFoundFee = _foundFee (#825)
- removeAllFee() (#919)
- _previousInviterFee = _inviterFee (#827)
- removeAllFee() (#919)
- _previousLiquidityFee = _liquidityFee (#822)
- removeAllFee() (#919)
- _previousRewardFee = _rewardFee (#823)
- removeAllFee() (#919)
- _previousTransferFee = _transferFee (#828)
- removeAllFee() (#919)
- _rewardFee = 0 (#831)
- restoreAllFee() (#930)
- _rewardFee = _previousRewardFee (#841)
- _transferFee = 10 (#907)
- _transferFee = 100 (#909)
- removeAllFee() (#919)
- _transferFee = 0 (#836)
- restoreAllFee() (#930)
- _transferFee = _previousTransferFee (#846)
- feeRate = 0 (#899)
- feeRate = _buyFee (#901)
- feeRate = _sellFee (#903)
- inviter[to] = from (#934)
- _takeMint() (#891)
- lastMintBlock = cycle.mul(28000).add(lastMintBlock) (#1122)
- _takeMint() (#891)
- nextMintBlock = lastMintBlock.add(28000) (#1123)
- _takeMint() (#891)
- unTakeMint = unTakeMint.add(amount) (#1116)
- unTakeMint = _maxSupply.sub(_totalSupply) (#1119)
Reentrancy in Token.constructor() (#581-609):
External calls:
- swapPairBNB = IPancakeFactory(_router.factory()).createPair(address(this),_router.WETH()) (#586-589)
- swapPair = IPancakeFactory(_router.factory()).createPair(address(this),usdAddress) (#590-593)
State variables written after the call(s):
- _balances[mintAddress] = 5160 * 10 ** 18 (#603)
- _isExcludedFromFee[ownerAddress] = true (#599)
- _isExcludedFromFee[mintAddress] = true (#600)
- _isExcludedFromFee[burnAddress] = true (#601)
- _isExcludedFromFee[address(this)] = true (#602)
- _isSwapPair[swapPair] = true (#594)
- _isSwapPair[swapPairBNB] = true (#595)
- transferOwnership(ownerAddress) (#606)
- _owner = newOwner (#147)
- transferOwnership(ownerAddress) (#606)
- _roles[_owner] = false (#145)
- _roles[newOwner] = true (#146)
- _totalSupply = 5160 * 10 ** 18 (#604)
- swapPair = IPancakeFactory(_router.factory()).createPair(address(this),usdAddress) (#590-593)
- swapRouter = _router (#596)
Reentrancy in Token.swapAndLiquify(uint256) (#1126-1150):
External calls:
- swapTokensForU(half) (#1138)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
- addLiquidity(otherHalf,newBalance) (#1146)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
State variables written after the call(s):
- addLiquidity(otherHalf,newBalance) (#1146)
- _allowances[owner][spender] = amount (#857)
Reentrancy in Token.transferFrom(address,address,uint256) (#672-687):
External calls:
- _transfer(sender,recipient,amount) (#677)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#678-685)
- _allowances[owner][spender] = amount (#857)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in Token._transfer(address,address,uint256) (#861-936):
External calls:
- swapAndLiquify(contractTokenBalance) (#888)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
Event emitted after the call(s):
- Transfer(sender,swapPair,rewardFee) (#1100)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,burnAddress,burnFee) (#1088)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,devAddress,devFee) (#1038)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,address(this),liquidityFee) (#1094)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,foundAddress,foundFee) (#1032)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,burnAddress,burnFee) (#1088)
- _transferStandard(from,to,amount) (#926)
- Transfer(sender,recipient,transferAmount) (#987)
- _transferStandard(from,to,amount) (#926)
- Transfer(sender,recipient,transferAmount) (#960)
- _transferSwap(from,to,amount) (#924)
- Transfer(sender,cur,inviterFee) (#1081)
- _transferSwap(from,to,amount) (#924)
Reentrancy in Token.constructor() (#581-609):
External calls:
- swapPairBNB = IPancakeFactory(_router.factory()).createPair(address(this),_router.WETH()) (#586-589)
- swapPair = IPancakeFactory(_router.factory()).createPair(address(this),usdAddress) (#590-593)
Event emitted after the call(s):
- OwnershipTransferred(_owner,newOwner) (#144)
- transferOwnership(ownerAddress) (#606)
- Transfer(address(0),mintAddress,5160 * 10 ** 18) (#608)
Reentrancy in Token.swapAndLiquify(uint256) (#1126-1150):
External calls:
- swapTokensForU(half) (#1138)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
- addLiquidity(otherHalf,newBalance) (#1146)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#858)
- addLiquidity(otherHalf,newBalance) (#1146)
- SwapAndLiquify(half,newBalance,otherHalf) (#1149)
Reentrancy in Token.transferFrom(address,address,uint256) (#672-687):
External calls:
- _transfer(sender,recipient,amount) (#677)
- IERC20(usdAddress).approve(address(swapRouter),uAmount) (#1174)
- swapRouter.addLiquidity(address(this),usdAddress,tokenAmount,uAmount,0,0,owner(),block.timestamp) (#1177-1186)
- swapRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1162-1168)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#858)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#678-685)
Apply the check-effects-interactions pattern.

Additional information: link

Context._msgData() (#103-106) is never used and should be removed
SafeMath.mod(uint256,uint256) (#54-56) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (#58-65) is never used and should be removed
Remove unused functions.

Additional information: link

Token._previousBuyFee (#524) is set pre-construction with a non-constant function or state variable:
- _buyFee
Token._previousSellFee (#527) is set pre-construction with a non-constant function or state variable:
- _sellFee
Token._previousLiquidityFee (#530) is set pre-construction with a non-constant function or state variable:
- _liquidityFee
Token._previousBurnFee (#536) is set pre-construction with a non-constant function or state variable:
- _burnFee
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Variable Ownable._owner (#110) is not in mixedCase
Function IPancakeRouter01.WETH() (#159) is not in mixedCase
Function IPancakePair.DOMAIN_SEPARATOR() (#425) is not in mixedCase
Function IPancakePair.PERMIT_TYPEHASH() (#427) is not in mixedCase
Function IPancakePair.MINIMUM_LIQUIDITY() (#458) is not in mixedCase
Parameter Token.setNumTokensSellToAddToLiquidity(uint256)._number (#726) is not in mixedCase
Parameter Token.setSwapAndLiquifyEnabled(bool)._enabled (#733) is not in mixedCase
Parameter Token.setLiquifyEnabled(bool)._enabled (#753) is not in mixedCase
Parameter Token.calculateLiquidityFee(uint256)._amount (#767) is not in mixedCase
Parameter Token.calculateRewardFee(uint256)._amount (#775) is not in mixedCase
Parameter Token.calculateBurnFee(uint256)._amount (#783) is not in mixedCase
Parameter Token.calculateFoundFee(uint256)._amount (#787) is not in mixedCase
Parameter Token.calculateDevFee(uint256)._amount (#791) is not in mixedCase
Parameter Token.calculateInviterFee(uint256)._amount (#795) is not in mixedCase
Parameter Token.calculateTransferFee(uint256)._amount (#803) is not in mixedCase
Variable Token._buyFee (#523) is not in mixedCase
Variable Token._sellFee (#526) is not in mixedCase
Variable Token._liquidityFee (#529) is not in mixedCase
Variable Token._rewardFee (#532) is not in mixedCase
Variable Token._burnFee (#535) is not in mixedCase
Variable Token._inviterFee (#538) is not in mixedCase
Variable Token._foundFee (#541) is not in mixedCase
Variable Token._devFee (#544) is not in mixedCase
Variable Token._transferFee (#547) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IPancakeRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#164) is too similar to IPancakeRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#165)
Prevent variables from having similar names.

Additional information: link

Token._transfer(address,address,uint256) (#861-936) uses literals with too many digits:
- _totalSupply.sub(_balances[burnAddress]) < 5000000 * 10 ** 18 (#906)
Token._takeMint() (#1103-1124) uses literals with too many digits:
- _totalSupply.sub(_balances[burnAddress]) < 5000000 * 10 ** 18 (#1110)
Token.slitherConstructorVariables() (#501-1189) uses literals with too many digits:
- _maxSupply = 1000000000 * 10 ** 18 (#506)
Token.slitherConstructorVariables() (#501-1189) uses literals with too many digits:
- burnAddress = address(0x000000000000000000000000000000000000dEaD) (#553-554)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

Token._excluded (#511) is never used in Token (#501-1189)
Token._previousBuyFee (#524) is never used in Token (#501-1189)
Token._previousSellFee (#527) is never used in Token (#501-1189)
Remove unused state variables.

Additional information: link

Token._buyFee (#523) should be constant
Token._maxSupply (#506) should be constant
Token._name (#513) should be constant
Token._sellFee (#526) should be constant
Token._symbol (#514) should be constant
Token.burnAddress (#553-554) should be constant
Token.devAddress (#559-560) should be constant
Token.foundAddress (#557-558) should be constant
Token.mintAddress (#561-562) should be constant
Token.ownerAddress (#555-556) should be constant
Token.usdAddress (#563-564) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#133-137)
setOwner(address,bool) should be declared external:
- Ownable.setOwner(address,bool) (#150-153)
name() should be declared external:
- Token.name() (#617-619)
symbol() should be declared external:
- Token.symbol() (#621-623)
decimals() should be declared external:
- Token.decimals() (#625-627)
totalSupply() should be declared external:
- Token.totalSupply() (#629-631)
transfer(address,uint256) should be declared external:
- Token.transfer(address,uint256) (#637-644)
allowance(address,address) should be declared external:
- Token.allowance(address,address) (#646-653)
approve(address,uint256) should be declared external:
- Token.approve(address,uint256) (#663-670)
transferFrom(address,address,uint256) should be declared external:
- Token.transferFrom(address,address,uint256) (#672-687)
increaseAllowance(address,uint256) should be declared external:
- Token.increaseAllowance(address,uint256) (#689-700)
decreaseAllowance(address,uint256) should be declared external:
- Token.decreaseAllowance(address,uint256) (#702-716)
setSwapPair(address,bool) should be declared external:
- Token.setSwapPair(address,bool) (#718-720)
setExcludedFromFee(address,bool) should be declared external:
- Token.setExcludedFromFee(address,bool) (#722-724)
setSwapAndLiquifyEnabled(bool) should be declared external:
- Token.setSwapAndLiquifyEnabled(bool) (#733-736)
takeMint() should be declared external:
- Token.takeMint() (#738-751)
setLiquifyEnabled(bool) should be declared external:
- Token.setLiquifyEnabled(bool) (#753-755)
isExcludedFromFee(address) should be declared external:
- Token.isExcludedFromFee(address) (#757-759)
Use the external attribute for functions never called from the contract.

Additional information: link

Average 30d PancakeSwap liquidity is less than $100. Token is either dead or inactive.

Number of Binance Smart Chain (BSC) token holders is less than 100. Token is either dead or inactive. Ignore for presale.

Contract has 8% buy tax and 3% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

Average 30d PancakeSwap volume is low.

Average 30d number of PancakeSwap swaps is low.

Token is deployed only at one blockchain

Unable to find website, listings and other project-related information

Young tokens have high risks of scam / price dump / death

Token is marked as scam (rug pull, honeypot, phishing, etc.)

Additional information: link

Token has no active CoinGecko listing / rank

Token has no active CoinMarketCap listing / rank