WHM TEST Token

TokenTool.addLiquidity(uint256,uint256) (#800-813) sends eth to arbitrary user
Dangerous calls:
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Reentrancy in TokenTool._transfer(address,address,uint256) (#709-747):
External calls:
- swapAndLiquify(contractTokenBalance) (#731)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#731)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#734)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#742)
- finalAmount = takeFee(sender,recipient,amount) (#736-737)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#827)
Apply the check-effects-interactions pattern.

Additional information: link

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.

Contract ownership is not renounced (belongs to a wallet)

TokenTool.addLiquidity(uint256,uint256) (#800-813) ignores return value by uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
Ensure that all the return values of the function calls are used.

Additional information: link

TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address).owner (#501) shadows:
- Ownable.owner() (#152-154) (function)
TokenTool.allowance(address,address).owner (#564) shadows:
- Ownable.owner() (#152-154) (function)
TokenTool._approve(address,address,uint256).owner (#587) shadows:
- Ownable.owner() (#152-154) (function)
Rename the local variables that shadow another component.

Additional information: link

TokenTool.setBuyTaxes(uint256,uint256,uint256) (#607-613) should emit an event for:
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyTeamFee) (#612)
TokenTool.setSelTaxes(uint256,uint256,uint256) (#615-621) should emit an event for:
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellTeamFee) (#620)
TokenTool.setDistributionSettings(uint256,uint256,uint256) (#623-629) should emit an event for:
- _liquidityShare = newLiquidityShare (#624)
- _teamShare = newTeamShare (#626)
- _totalDistributionShares = _liquidityShare.add(_marketingShare).add(_teamShare) (#628)
TokenTool.setMaxTxAmount(uint256) (#631-633) should emit an event for:
- _maxTxAmount = maxTxAmount (#632)
TokenTool.setWalletLimit(uint256) (#643-645) should emit an event for:
- _walletMax = newLimit (#644)
TokenTool.setNumTokensBeforeSwap(uint256) (#647-649) should emit an event for:
- _minimumTokensBeforeSwap = newLimit (#648)
Emit an event for critical parameter changes.

Additional information: link

TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address).owner (#501) lacks a zero-check on :
- _owner = owner (#515)
TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address).marketingAddress (#502) lacks a zero-check on :
- marketingWalletAddress = address(marketingAddress) (#520)
TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address).teamAddress (#503) lacks a zero-check on :
- teamWalletAddress = address(teamAddress) (#521)
TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address).service (#504) lacks a zero-check on :
- address(service).transfer(msg.value) (#540)
TokenTool.setMarketingWalletAddress(address).newAddress (#651) lacks a zero-check on :
- marketingWalletAddress = address(newAddress) (#652)
TokenTool.setTeamWalletAddress(address).newAddress (#655) lacks a zero-check on :
- teamWalletAddress = address(newAddress) (#656)
Check that the address is not zero.

Additional information: link

Reentrancy in TokenTool.changeRouterVersion(address) (#676-693):
External calls:
- newPairAddress = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#684-685)
State variables written after the call(s):
- isMarketPair[address(uniswapPair)] = true (#692)
- isWalletLimitExempt[address(uniswapPair)] = true (#691)
- uniswapPair = newPairAddress (#688)
- uniswapV2Router = _uniswapV2Router (#689)
Reentrancy in TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address) (#495-542):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#509-510)
State variables written after the call(s):
- _allowances[address(this)][address(uniswapV2Router)] = _totalSupply (#526)
- _balances[owner] = _totalSupply (#539)
- _decimals = coinDecimals (#514)
- _maxTxAmount = supply * 10 ** _decimals (#517)
- _minimumTokensBeforeSwap = 1 * 10 ** _decimals (#519)
- _name = coinName (#512)
- _owner = owner (#515)
- _symbol = coinSymbol (#513)
- _totalDistributionShares = _liquidityShare.add(_marketingShare).add(_teamShare) (#524)
- _totalSupply = supply * 10 ** _decimals (#516)
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyTeamFee) (#522)
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellTeamFee) (#523)
- _walletMax = supply * 10 ** _decimals (#518)
- isExcludedFromFee[owner] = true (#527)
- isExcludedFromFee[address(this)] = true (#528)
- isMarketPair[address(uniswapPair)] = true (#537)
- isTxLimitExempt[owner] = true (#534)
- isTxLimitExempt[address(this)] = true (#535)
- isWalletLimitExempt[owner] = true (#530)
- isWalletLimitExempt[address(uniswapPair)] = true (#531)
- isWalletLimitExempt[address(this)] = true (#532)
- marketingWalletAddress = address(marketingAddress) (#520)
- teamWalletAddress = address(teamAddress) (#521)
- uniswapV2Router = _uniswapV2Router (#525)
Reentrancy in TokenTool.swapAndLiquify(uint256) (#756-778):
External calls:
- swapTokensForEth(tokensForSwap) (#761)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#771)
- recipient.transfer(amount) (#673)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#774)
- recipient.transfer(amount) (#673)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- _allowances[owner][spender] = amount (#591)
Reentrancy in TokenTool.transferFrom(address,address,uint256) (#703-707):
External calls:
- _transfer(sender,recipient,amount) (#704)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
External calls sending eth:
- _transfer(sender,recipient,amount) (#704)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#705)
- _allowances[owner][spender] = amount (#591)
Apply the check-effects-interactions pattern.

Additional information: link

Reentrancy in TokenTool._transfer(address,address,uint256) (#709-747):
External calls:
- swapAndLiquify(contractTokenBalance) (#731)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#731)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#828)
- finalAmount = takeFee(sender,recipient,amount) (#736-737)
- Transfer(sender,recipient,finalAmount) (#744)
Reentrancy in TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address) (#495-542):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#509-510)
External calls sending eth:
- address(service).transfer(msg.value) (#540)
Event emitted after the call(s):
- Transfer(address(0),owner,_totalSupply) (#541)
Reentrancy in TokenTool.swapAndLiquify(uint256) (#756-778):
External calls:
- swapTokensForEth(tokensForSwap) (#761)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#771)
- recipient.transfer(amount) (#673)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#774)
- recipient.transfer(amount) (#673)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#592)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
Reentrancy in TokenTool.swapTokensForEth(uint256) (#780-798):
External calls:
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
Event emitted after the call(s):
- SwapTokensForETH(tokenAmount,path) (#797)
Reentrancy in TokenTool.transferFrom(address,address,uint256) (#703-707):
External calls:
- _transfer(sender,recipient,amount) (#704)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#789-795)
External calls sending eth:
- _transfer(sender,recipient,amount) (#704)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#592)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#705)
Apply the check-effects-interactions pattern.

Additional information: link

Address.isContract(address) (#90-99) uses assembly
- INLINE ASM (#97)
Address._functionCallWithValue(address,bytes,uint256,string) (#126-143) uses assembly
- INLINE ASM (#135-138)
Do not use evm assembly.

Additional information: link

Address._functionCallWithValue(address,bytes,uint256,string) (#126-143) is never used and should be removed
Address.functionCall(address,bytes) (#109-111) is never used and should be removed
Address.functionCall(address,bytes,string) (#113-115) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#117-119) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#121-124) is never used and should be removed
Address.isContract(address) (#90-99) is never used and should be removed
Address.sendValue(address,uint256) (#101-107) is never used and should be removed
Context._msgData() (#10-14) is never used and should be removed
SafeMath.mod(uint256,uint256) (#78-80) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (#82-85) is never used and should be removed
Remove unused functions.

Additional information: link

Low level call in Address.sendValue(address,uint256) (#101-107):
- (success) = recipient.call{value: amount}() (#105)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#126-143):
- (success,returndata) = target.call{value: weiValue}(data) (#129)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Variable Ownable._owner (#147) is not in mixedCase
Function IUniswapV2Pair.DOMAIN_SEPARATOR() (#220) is not in mixedCase
Function IUniswapV2Pair.PERMIT_TYPEHASH() (#222) is not in mixedCase
Function IUniswapV2Pair.MINIMUM_LIQUIDITY() (#239) is not in mixedCase
Function IUniswapV2Router01.WETH() (#269) is not in mixedCase
Parameter TokenTool.setSwapAndLiquifyEnabled(bool)._enabled (#659) is not in mixedCase
Variable TokenTool._balances (#432) is not in mixedCase
Variable TokenTool._buyLiquidityFee (#440) is not in mixedCase
Variable TokenTool._buyMarketingFee (#441) is not in mixedCase
Variable TokenTool._buyTeamFee (#442) is not in mixedCase
Variable TokenTool._sellLiquidityFee (#444) is not in mixedCase
Variable TokenTool._sellMarketingFee (#445) is not in mixedCase
Variable TokenTool._sellTeamFee (#446) is not in mixedCase
Variable TokenTool._liquidityShare (#448) is not in mixedCase
Variable TokenTool._marketingShare (#449) is not in mixedCase
Variable TokenTool._teamShare (#450) is not in mixedCase
Variable TokenTool._totalDistributionShares (#451) is not in mixedCase
Variable TokenTool._totalTaxIfBuying (#453) is not in mixedCase
Variable TokenTool._totalTaxIfSelling (#454) is not in mixedCase
Variable TokenTool._maxTxAmount (#458) is not in mixedCase
Variable TokenTool._walletMax (#459) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

Redundant expression "this (#11)" inContext (#4-15)
Remove redundant statements if they congest code but offer no value.

Additional information: link

Reentrancy in TokenTool._transfer(address,address,uint256) (#709-747):
External calls:
- swapAndLiquify(contractTokenBalance) (#731)
- recipient.transfer(amount) (#673)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#731)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#734)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#742)
- finalAmount = takeFee(sender,recipient,amount) (#736-737)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#827)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#828)
- finalAmount = takeFee(sender,recipient,amount) (#736-737)
- Transfer(sender,recipient,finalAmount) (#744)
Reentrancy in TokenTool.constructor(string,string,uint8,uint256,address,address,address,address,address) (#495-542):
External calls:
- address(service).transfer(msg.value) (#540)
Event emitted after the call(s):
- Transfer(address(0),owner,_totalSupply) (#541)
Reentrancy in TokenTool.swapAndLiquify(uint256) (#756-778):
External calls:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#771)
- recipient.transfer(amount) (#673)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#774)
- recipient.transfer(amount) (#673)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarketing) (#771)
- recipient.transfer(amount) (#673)
- transferToAddressETH(teamWalletAddress,amountBNBTeam) (#774)
- recipient.transfer(amount) (#673)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
- _allowances[owner][spender] = amount (#591)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#592)
- addLiquidity(tokensForLP,amountBNBLiquidity) (#777)
Reentrancy in TokenTool.transferFrom(address,address,uint256) (#703-707):
External calls:
- _transfer(sender,recipient,amount) (#704)
- recipient.transfer(amount) (#673)
External calls sending eth:
- _transfer(sender,recipient,amount) (#704)
- recipient.transfer(amount) (#673)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#805-812)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#705)
- _allowances[owner][spender] = amount (#591)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#592)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#705)
Apply the check-effects-interactions pattern.

Additional information: link

Variable IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#274) is too similar to IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#275)
Prevent variables from having similar names.

Additional information: link

TokenTool.slitherConstructorVariables() (#420-835) uses literals with too many digits:
- deadAddress = 0x000000000000000000000000000000000000dEaD (#430)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

waiveOwnership() should be declared external:
- Ownable.waiveOwnership() (#161-164)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#166-170)
getTime() should be declared external:
- Ownable.getTime() (#172-174)
name() should be declared external:
- TokenTool.name() (#544-546)
symbol() should be declared external:
- TokenTool.symbol() (#548-550)
decimals() should be declared external:
- TokenTool.decimals() (#552-554)
totalSupply() should be declared external:
- TokenTool.totalSupply() (#556-558)
allowance(address,address) should be declared external:
- TokenTool.allowance(address,address) (#564-566)
increaseAllowance(address,uint256) should be declared external:
- TokenTool.increaseAllowance(address,uint256) (#568-571)
decreaseAllowance(address,uint256) should be declared external:
- TokenTool.decreaseAllowance(address,uint256) (#573-576)
minimumTokensBeforeSwapAmount() should be declared external:
- TokenTool.minimumTokensBeforeSwapAmount() (#578-580)
approve(address,uint256) should be declared external:
- TokenTool.approve(address,uint256) (#582-585)
setMarketPairStatus(address,bool) should be declared external:
- TokenTool.setMarketPairStatus(address,bool) (#595-597)
setIsExcludedFromFee(address,bool) should be declared external:
- TokenTool.setIsExcludedFromFee(address,bool) (#603-605)
setSwapAndLiquifyEnabled(bool) should be declared external:
- TokenTool.setSwapAndLiquifyEnabled(bool) (#659-662)
setSwapAndLiquifyByLimitOnly(bool) should be declared external:
- TokenTool.setSwapAndLiquifyByLimitOnly(bool) (#664-666)
getCirculatingSupply() should be declared external:
- TokenTool.getCirculatingSupply() (#668-670)
changeRouterVersion(address) should be declared external:
- TokenTool.changeRouterVersion(address) (#676-693)
transfer(address,uint256) should be declared external:
- TokenTool.transfer(address,uint256) (#698-701)
transferFrom(address,address,uint256) should be declared external:
- TokenTool.transferFrom(address,address,uint256) (#703-707)
Use the external attribute for functions never called from the contract.

Additional information: link

Contract ticker (WHM TEST) contains non-alphanumeric characters.
Not a direct threat, but may indicate unreliable intentions of developer. Non-alphanumeric chars (,.;!#*&") are extremely rare among low risk tokens.

Token seems to be untradeable: there is no PancakeSwap trading pair and no trading volumes. Ignore for presale.

Unable to find website, listings and other project-related information

Young tokens have high risks of price dump / death

Token has no active CoinGecko listing / rank

Token has no active CoinMarketCap listing / rank