Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
TRex.addLiquidity(uint256,uint256) (#633-646) sends eth to arbitrary user
Dangerous calls:
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in TRex._transfer(address,address,uint256) (#515-563):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
- _rOwned[address(this)] += rMarketing (#402)
- _rOwned[address(this)] += rOperation (#432)
- _rOwned[address(this)] += rLiquidity (#392)
- _rOwned[address(this)] += rCharity (#422)
- _rOwned[address(this)] += rDev (#412)
- _rOwned[sender] = _rOwned[sender] - s.rAmount (#578)
- _rOwned[recipient] = _rOwned[recipient] + s.rTransferAmount (#579)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
- _rTotal -= rRfi (#381)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
- _tOwned[address(this)] += tCharity (#420)
- _tOwned[address(this)] += tDev (#410)
- _tOwned[address(this)] += tMarketing (#400)
- _tOwned[address(this)] += tOperation (#430)
- _tOwned[address(this)] += tLiquidity (#390)
- _tOwned[sender] = _tOwned[sender] - tAmount (#572)
- _tOwned[recipient] = _tOwned[recipient] + s.tTransferAmount (#575)
Apply the check-effects-interactions pattern.
Additional information: link
TRex.rescueAnyBEP20Tokens(address,address,uint256) (#744-746) ignores return value by IERC20(_tokenAddr).transfer(_to,_amount) (#745)
Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 2: Unchecked transfer + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Combination 3: Reentrancy vulnerabilities + Unchecked transfer vulnerability. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#604)
-bnbToAddLiquidityWith = unitBalance * temp.liquidity (#605)
TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#604)
-marketingAmt = unitBalance * 2 * temp.marketing (#612)
TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#604)
-devAmt = unitBalance * 2 * temp.dev (#616)
TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#604)
-charityAmt = unitBalance * 2 * temp.charity (#621)
TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631) performs a multiplication on the result of a division:
-unitBalance = deltaBalance / (denominator - temp.liquidity) (#604)
-operationAmt = unitBalance * 2 * temp.operation (#626)
Consider ordering multiplication before division.
Additional information: link
TRex.addLiquidity(uint256,uint256) (#633-646) ignores return value by router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
Ensure that all the return values of the function calls are used.
Additional information: link
TRex.allowance(address,address).owner (#267) shadows:
- Ownable.owner() (#53-55) (function)
TRex._approve(address,address,uint256).owner (#508) shadows:
- Ownable.owner() (#53-55) (function)
Rename the local variables that shadow another component.
Additional information: link
TRex.updateCooldown(bool,uint256) (#695-698) should emit an event for:
- coolDownTime = time * 1 (#696)
TRex.updateSwapTokensAtAmount(uint256) (#700-702) should emit an event for:
- swapTokensAtAmount = amount * 10 ** _decimals (#701)
TRex.updateMaxTxLimit(uint256,uint256) (#723-726) should emit an event for:
- maxBuyLimit = maxBuy * 10 ** decimals() (#724)
- maxSellLimit = maxSell * 10 ** decimals() (#725)
TRex.updateMaxWalletlimit(uint256) (#728-730) should emit an event for:
- maxWalletLimit = amount * 10 ** decimals() (#729)
Emit an event for critical parameter changes.
Additional information: link
TRex.constructor(address)._pair (#219-220) lacks a zero-check on :
- pair = _pair (#223)
TRex.updateMarketingWallet(address).newWallet (#679) lacks a zero-check on :
- marketingWallet = newWallet (#680)
TRex.updateDevWallet(address).newWallet (#683) lacks a zero-check on :
- devWallet = newWallet (#684)
TRex.updateCharityWallet(address).newWallet (#687) lacks a zero-check on :
- charityWallet = newWallet (#688)
TRex.updateOperationWallet(address).newWallet (#691) lacks a zero-check on :
- operationWallet = newWallet (#692)
TRex.updateRouterAndPair(address,address).newPair (#732) lacks a zero-check on :
- pair = newPair (#734)
Check that the address is not zero.
Additional information: link
Reentrancy in TRex._transfer(address,address,uint256) (#515-563):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
State variables written after the call(s):
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
- totFeesPaid.dev += tDev (#406)
- totFeesPaid.operation += tOperation (#426)
- totFeesPaid.marketing += tMarketing (#396)
- totFeesPaid.liquidity += tLiquidity (#386)
- totFeesPaid.charity += tCharity (#416)
- totFeesPaid.rfi += tRfi (#382)
Reentrancy in TRex.constructor(address) (#217-244):
External calls:
- _pair = IFactory(_router.factory()).createPair(address(this),_router.WETH()) (#219-220)
State variables written after the call(s):
- excludeFromReward(pair) (#225)
- _excluded.push(account) (#340)
- excludeFromReward(pair) (#225)
- _isExcluded[account] = true (#339)
- _isExcludedFromFee[address(this)] = true (#228)
- _isExcludedFromFee[owner()] = true (#229)
- _isExcludedFromFee[marketingWallet] = true (#230)
- _isExcludedFromFee[devWallet] = true (#231)
- _isExcludedFromFee[charityWallet] = true (#232)
- _isExcludedFromFee[operationWallet] = true (#233)
- _rOwned[owner()] = _rTotal (#227)
- excludeFromReward(pair) (#225)
- _tOwned[account] = tokenFromReflection(_rOwned[account]) (#337)
- allowedTransfer[address(this)] = true (#235)
- allowedTransfer[owner()] = true (#236)
- allowedTransfer[pair] = true (#237)
- allowedTransfer[marketingWallet] = true (#238)
- allowedTransfer[devWallet] = true (#239)
- allowedTransfer[charityWallet] = true (#240)
- allowedTransfer[operationWallet] = true (#241)
- pair = _pair (#223)
- router = _router (#222)
Reentrancy in TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631):
External calls:
- swapTokensForBNB(toSwap) (#601)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
External calls sending eth:
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
State variables written after the call(s):
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
- _allowances[owner][spender] = amount (#511)
Reentrancy in TRex.transferFrom(address,address,uint256) (#276-284):
External calls:
- _transfer(sender,recipient,amount) (#277)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
External calls sending eth:
- _transfer(sender,recipient,amount) (#277)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
State variables written after the call(s):
- _approve(sender,_msgSender(),currentAllowance - amount) (#281)
- _allowances[owner][spender] = amount (#511)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in TRex._transfer(address,address,uint256) (#515-563):
External calls:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
External calls sending eth:
- swapAndLiquify(swapTokensAtAmount,sellTaxes) (#554)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- swapAndLiquify(swapTokensAtAmount,taxes) (#555)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
Event emitted after the call(s):
- Transfer(sender,address(this),s.tLiquidity + s.tMarketing + s.tDev + s.tCharity + s.tOperation) (#584)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
- Transfer(sender,recipient,s.tTransferAmount) (#590)
- _tokenTransfer(from,to,amount,takeFee,isSell) (#562)
Reentrancy in TRex.constructor(address) (#217-244):
External calls:
- _pair = IFactory(_router.factory()).createPair(address(this),_router.WETH()) (#219-220)
Event emitted after the call(s):
- Transfer(address(0),owner(),_tTotal) (#243)
Reentrancy in TRex.swapAndLiquify(uint256,TRex.Taxes) (#594-631):
External calls:
- swapTokensForBNB(toSwap) (#601)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
External calls sending eth:
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#512)
- addLiquidity(tokensToAddLiquidityWith,bnbToAddLiquidityWith) (#609)
Reentrancy in TRex.transferFrom(address,address,uint256) (#276-284):
External calls:
- _transfer(sender,recipient,amount) (#277)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#657-663)
- address(marketingWallet).sendValue(marketingAmt) (#614)
- address(devWallet).sendValue(devAmt) (#618)
- address(charityWallet).sendValue(charityAmt) (#623)
- address(operationWallet).sendValue(operationAmt) (#628)
External calls sending eth:
- _transfer(sender,recipient,amount) (#277)
- router.addLiquidityETH{value: bnbAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#638-645)
- (success) = recipient.call{value: amount}() (#106)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#512)
- _approve(sender,_msgSender(),currentAllowance - amount) (#281)
Apply the check-effects-interactions pattern.
Additional information: link
TRex._transfer(address,address,uint256) (#515-563) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(timePassed >= coolDownTime,Cooldown enabled) (#542)
Avoid relying on block.timestamp.
Additional information: link
TRex.setTradingStatus(bool) (#321-325) compares to a boolean constant:
-state == true && genesis_block == 0 (#324)
Remove the equality to the boolean constant.
Additional information: link
TRex.includeInReward(address) (#343-354) has costly operations inside a loop:
- _excluded.pop() (#350)
TRex._reflectRfi(uint256,uint256) (#380-383) has costly operations inside a loop:
- _rTotal -= rRfi (#381)
Use a local variable to hold the loop computation result.
Additional information: link
Context._msgData() (#38-41) is never used and should be removed
Remove unused functions.
Additional information: link
TRex._rTotal (#148) is set pre-construction with a non-constant function or state variable:
- (MAX - (MAX % _tTotal))
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in Address.sendValue(address,uint256) (#103-108):
- (success) = recipient.call{value: amount}() (#106)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IRouter.WETH() (#84) is not in mixedCase
Struct TRex.valuesFromGetValues (#190-206) is not in CapWords
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._rfi (#370) is not in mixedCase
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._marketing (#370) is not in mixedCase
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._liquidity (#370) is not in mixedCase
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._dev (#370) is not in mixedCase
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._operation (#370) is not in mixedCase
Parameter TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._charity (#370) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._rfi (#375) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._marketing (#375) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._liquidity (#375) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._dev (#375) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._operation (#375) is not in mixedCase
Parameter TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256)._charity (#375) is not in mixedCase
Parameter TRex.updateSwapEnabled(bool)._enabled (#704) is not in mixedCase
Parameter TRex.rescueAnyBEP20Tokens(address,address,uint256)._tokenAddr (#744) is not in mixedCase
Parameter TRex.rescueAnyBEP20Tokens(address,address,uint256)._to (#744) is not in mixedCase
Parameter TRex.rescueAnyBEP20Tokens(address,address,uint256)._amount (#744) is not in mixedCase
Constant TRex._decimals (#144) is not in UPPER_CASE_WITH_UNDERSCORES
Variable TRex.genesis_block (#155) is not in mixedCase
Constant TRex._name (#162) is not in UPPER_CASE_WITH_UNDERSCORES
Constant TRex._symbol (#163) is not in UPPER_CASE_WITH_UNDERSCORES
Follow the Solidity naming convention.
Additional information: link
Redundant expression "this (#39)" inContext (#33-42)
Remove redundant statements if they congest code but offer no value.
Additional information: link
TRex._tTotal (#147) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
renounceOwnership() should be declared external:
- Ownable.renounceOwnership() (#62-64)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#66-69)
name() should be declared external:
- TRex.name() (#247-249)
symbol() should be declared external:
- TRex.symbol() (#250-252)
totalSupply() should be declared external:
- TRex.totalSupply() (#258-260)
allowance(address,address) should be declared external:
- TRex.allowance(address,address) (#267-269)
approve(address,uint256) should be declared external:
- TRex.approve(address,uint256) (#271-274)
transferFrom(address,address,uint256) should be declared external:
- TRex.transferFrom(address,address,uint256) (#276-284)
increaseAllowance(address,uint256) should be declared external:
- TRex.increaseAllowance(address,uint256) (#286-289)
decreaseAllowance(address,uint256) should be declared external:
- TRex.decreaseAllowance(address,uint256) (#291-297)
transfer(address,uint256) should be declared external:
- TRex.transfer(address,uint256) (#299-303)
isExcludedFromReward(address) should be declared external:
- TRex.isExcludedFromReward(address) (#305-307)
reflectionFromToken(uint256,bool) should be declared external:
- TRex.reflectionFromToken(uint256,bool) (#309-318)
excludeFromFee(address) should be declared external:
- TRex.excludeFromFee(address) (#357-359)
includeInFee(address) should be declared external:
- TRex.includeInFee(address) (#361-363)
isExcludedFromFee(address) should be declared external:
- TRex.isExcludedFromFee(address) (#366-368)
setTaxes(uint256,uint256,uint256,uint256,uint256,uint256) should be declared external:
- TRex.setTaxes(uint256,uint256,uint256,uint256,uint256,uint256) (#370-373)
setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256) should be declared external:
- TRex.setSellTaxes(uint256,uint256,uint256,uint256,uint256,uint256) (#375-378)
rescueAnyBEP20Tokens(address,address,uint256) should be declared external:
- TRex.rescueAnyBEP20Tokens(address,address,uint256) (#744-746)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts