TCG2 [TCGCoin 2.0] Token

Reentrancy in TCGCoin20._transfer(address,address,uint256) (#1114-1155):
External calls:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _reflectOwned[address(this)] = _reflectOwned[address(this)].add(rLiquidity) (#1020)
- _reflectOwned[sender] = _reflectOwned[sender].sub(reflectAmount) (#1168)
- _reflectOwned[recipient] = _reflectOwned[recipient].add(reflectAmountToTransfer) (#1169)
- _reflectOwned[sender] = _reflectOwned[sender].sub(reflectAmount) (#1174)
- _reflectOwned[recipient] = _reflectOwned[recipient].add(reflectAmountToTransfer) (#1176)
- _reflectOwned[sender] = _reflectOwned[sender].sub(reflectAmount) (#1182)
- _reflectOwned[recipient] = _reflectOwned[recipient].add(reflectAmountToTransfer) (#1184)
- _reflectOwned[sender] = _reflectOwned[sender].sub(reflectAmount) (#1189)
- _reflectOwned[recipient] = _reflectOwned[recipient].add(reflectAmountToTransfer) (#1190)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _reflectTotal = _reflectTotal.sub(rFee) (#899)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _takeOwned[address(this)] = _takeOwned[address(this)].add(tLiquidity) (#1022)
- _takeOwned[sender] = _takeOwned[sender].sub(amount) (#1167)
- _takeOwned[recipient] = _takeOwned[recipient].add(takeAmountToTransfer) (#1175)
- _takeOwned[sender] = _takeOwned[sender].sub(amount) (#1181)
- _takeOwned[recipient] = _takeOwned[recipient].add(takeAmountToTransfer) (#1183)
Apply the check-effects-interactions pattern.

Additional information: link

Unable to verify that contract auditor is trusted: Certik, Quantstamp, Hacken, Solidity, Paladinsec, Openzeppelin, Verichains

Contract ownership is not renounced (belongs to a wallet)

TCGCoin20._takeTotal (#677) should be constant
TCGCoin20.numTokensSellToAddToLiquidity (#711) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

TCGCoin20.addLiquidity(uint256,uint256) (#1066-1080) ignores return value by pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
Ensure that all the return values of the function calls are used.

Additional information: link

TCGCoin20._approve(address,address,uint256).owner (#835) shadows:
- Ownable.owner() (#513-515) (function)
TCGCoin20.allowance(address,address).owner (#790) shadows:
- Ownable.owner() (#513-515) (function)
Rename the local variables that shadow another component.

Additional information: link

TCGCoin20.setPancakeSwap(address).account (#882) lacks a zero-check on :
- _pancakeSwap = account (#884)
Check that the address is not zero.

Additional information: link

Reentrancy in TCGCoin20.transferFrom(address,address,uint256) (#800-805):
External calls:
- _transfer(sender,recipient,amount) (#801)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
External calls sending eth:
- _transfer(sender,recipient,amount) (#801)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,BEP20: transfer amount exceeds allowance)) (#802)
- _allowances[owner][spender] = amount (#839)
Reentrancy in TCGCoin20.swapAndLiquify(uint256) (#1025-1046):
External calls:
- swapTokensForBNB(half) (#1037)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
- addLiquidity(otherHalf,newBalance) (#1043)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
External calls sending eth:
- addLiquidity(otherHalf,newBalance) (#1043)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
State variables written after the call(s):
- addLiquidity(otherHalf,newBalance) (#1043)
- _allowances[owner][spender] = amount (#839)
Reentrancy in TCGCoin20._transfer(address,address,uint256) (#1114-1155):
External calls:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _liquidityFee = _previousLiquidityFee (#954)
- _liquidityFee = 0 (#949)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _previousLiquidityFee = _liquidityFee (#946)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _previousTaxFee = _taxFee (#945)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _takeFeeTotal = _takeFeeTotal.add(tFee) (#900)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
- _taxFee = _previousTaxFee (#953)
- _taxFee = 0 (#948)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in TCGCoin20.swapAndLiquify(uint256) (#1025-1046):
External calls:
- swapTokensForBNB(half) (#1037)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
- addLiquidity(otherHalf,newBalance) (#1043)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
External calls sending eth:
- addLiquidity(otherHalf,newBalance) (#1043)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
Event emitted after the call(s):
- AddLiquidity(tokenAmount,bnbAmount) (#1067)
- addLiquidity(otherHalf,newBalance) (#1043)
- Approval(owner,spender,amount) (#840)
- addLiquidity(otherHalf,newBalance) (#1043)
- SwapAndLiquifyEvent(half,newBalance,otherHalf) (#1045)
Reentrancy in TCGCoin20._transfer(address,address,uint256) (#1114-1155):
External calls:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#1142)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
Event emitted after the call(s):
- Transfer(sender,recipient,takeAmountToTransfer) (#1197)
- _tokenTransfer(from,to,amount,takeFee) (#1154)
Reentrancy in TCGCoin20.transferFrom(address,address,uint256) (#800-805):
External calls:
- _transfer(sender,recipient,amount) (#801)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
- pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#1057-1063)
External calls sending eth:
- _transfer(sender,recipient,amount) (#801)
- pancakeRouter.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#1072-1079)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#840)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,BEP20: transfer amount exceeds allowance)) (#802)
Apply the check-effects-interactions pattern.

Additional information: link

Ownable.unlock() (#560-565) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(block.timestamp > _lockTime,Contract is locked until 7 days) (#562)
Avoid relying on block.timestamp.

Additional information: link

Address._functionCallWithValue(address,bytes,uint256,string) (#609-630) uses assembly
- INLINE ASM (#622-625)
Address.isContract(address) (#573-582) uses assembly
- INLINE ASM (#580)
Do not use evm assembly.

Additional information: link

SafeMath.tryDiv(uint256,uint256) (#317-322) is never used and should be removed
Address.sendValue(address,uint256) (#584-590) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#600-602) is never used and should be removed
SafeMath.tryMod(uint256,uint256) (#329-334) is never used and should be removed
SafeMath.tryAdd(uint256,uint256) (#275-281) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (#470-479) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#604-607) is never used and should be removed
SafeMath.div(uint256,uint256,string) (#444-453) is never used and should be removed
Context._msgData() (#38-40) is never used and should be removed
SafeMath.mod(uint256,uint256) (#404-406) is never used and should be removed
SafeMath.tryMul(uint256,uint256) (#300-310) is never used and should be removed
SafeMath.trySub(uint256,uint256) (#288-293) is never used and should be removed
Address._functionCallWithValue(address,bytes,uint256,string) (#609-630) is never used and should be removed
Address.isContract(address) (#573-582) is never used and should be removed
Address.functionCall(address,bytes,string) (#596-598) is never used and should be removed
Address.functionCall(address,bytes) (#592-594) is never used and should be removed
Remove unused functions.

Additional information: link

TCGCoin20._reflectTotal (#678) is set pre-construction with a non-constant function or state variable:
- (MAX - (MAX % _takeTotal))
TCGCoin20._previousLiquidityFee (#694) is set pre-construction with a non-constant function or state variable:
- _liquidityFee
TCGCoin20._previousTaxFee (#691) is set pre-construction with a non-constant function or state variable:
- _taxFee
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.

Additional information: link

Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#609-630):
- (success,returndata) = target.call{value: weiValue}(data) (#613)
Low level call in Address.sendValue(address,uint256) (#584-590):
- (success) = recipient.call{value: amount}() (#588)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Constant TCGCoin20._name (#681) is not in UPPER_CASE_WITH_UNDERSCORES
Function IPancakeRouter01.WETH() (#67) is not in mixedCase
Variable TCGCoin20._pancakeSwap (#687) is not in mixedCase
Variable TCGCoin20._taxFee (#690) is not in mixedCase
Variable TCGCoin20._maximumValueOfTransaction (#710) is not in mixedCase
Parameter TCGCoin20.setSwapAndLiquifyEnabled(bool)._enabled (#1007) is not in mixedCase
Variable TCGCoin20._liquidityFee (#693) is not in mixedCase
Function IPancakePair.MINIMUM_LIQUIDITY() (#243) is not in mixedCase
Function IPancakeFactory.INIT_CODE_PAIR_HASH() (#62) is not in mixedCase
Function IPancakePair.PERMIT_TYPEHASH() (#227) is not in mixedCase
Function IPancakePair.DOMAIN_SEPARATOR() (#226) is not in mixedCase
Constant TCGCoin20._decimals (#683) is not in UPPER_CASE_WITH_UNDERSCORES
Variable TCGCoin20._maxLoopCount (#704) is not in mixedCase
Parameter TCGCoin20.calculateTaxFee(uint256)._amount (#850) is not in mixedCase
Parameter TCGCoin20.calculateLiquidityFee(uint256)._amount (#856) is not in mixedCase
Constant TCGCoin20._symbol (#682) is not in UPPER_CASE_WITH_UNDERSCORES
Variable TCGCoin20._taxFeeFlag (#688) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Variable IPancakeRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#72) is too similar to IPancakeRouter01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#73)
Prevent variables from having similar names.

Additional information: link

TCGCoin20.slitherConstructorVariables() (#644-1202) uses literals with too many digits:
- _pancakeSwap = 0x0000000000000000000000000000000000000000 (#687)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#532-535)
decimals() should be declared external:
- TCGCoin20.decimals() (#772-774)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#541-545)
isExcludedFromFee(address) should be declared external:
- TCGCoin20.isExcludedFromFee(address) (#1000-1002)
unlock() should be declared external:
- Ownable.unlock() (#560-565)
lock(uint256) should be declared external:
- Ownable.lock(uint256) (#552-557)
getUnlockTime() should be declared external:
- Ownable.getUnlockTime() (#547-549)
Use the external attribute for functions never called from the contract.

Additional information: link

TCGCoin20.includeInReward(address) (#971-984) has costly operations inside a loop:
- _excluded.pop() (#980)
Use a local variable to hold the loop computation result.

Additional information: link

Contract name (TCGCoin 2.0) contains non-alphanumeric characters.
Not a direct threat, but may indicate unreliable intentions of developer. Non-alphanumeric chars (,.;!#*&") are extremely rare among low risk tokens.

Contract has 0% buy tax and 10% sell tax.
Taxes are low but contract ownership is not renounced. Token has a high risk of becoming a honeypot.

BscScan page for the token does not contain additional info: website, socials, description, etc.

Additional information: link

Unable to find audit link on the website

Unable to find token on CoinHunt

Additional information: link

Unable to find code repository for the project

Token is not listed at Mobula.Finance

Additional information: link

Token has relatively low CoinGecko rank