Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
Winky.swapBack() (#365-406) sends eth to arbitrary user
Dangerous calls:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in Winky._transferFrom(address,address,uint256) (#289-318):
External calls:
- swapBack() (#307)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#376-382)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
External calls sending eth:
- swapBack() (#307)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#311)
- _balances[recipient] = _balances[recipient].add(amountReceived) (#314)
- amountReceived = takeFee(sender,recipient,amount) (#313)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#344)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Winky.slitherConstructorVariables() (#185-502) uses literals with too many digits:
- DEAD = 0x000000000000000000000000000000000000dEaD (#189)
Winky.slitherConstructorVariables() (#185-502) uses literals with too many digits:
- ZERO = 0x0000000000000000000000000000000000000000 (#190)
Winky.slitherConstructorVariables() (#185-502) uses literals with too many digits:
- _totalSupply = 10000000 * (10 ** _decimals) (#197)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
Winky.DEAD (#189) should be constant
Winky.WBNB (#188) should be constant
Winky.ZERO (#190) should be constant
Winky._totalSupply (#197) should be constant
Winky.routerAddress (#191) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
Winky.slitherConstructorVariables() (#185-502) performs a multiplication on the result of a division:
-swapThreshold = _totalSupply / 1000 * 3 (#226)
Consider ordering multiplication before division.
Additional information: link
Winky.swapBack() (#365-406) ignores return value by router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
Ensure that all the return values of the function calls are used.
Additional information: link
Winky.setFees(uint256,uint256,uint256,uint256) (#435-442) should emit an event for:
- liquidityFee = _liquidityFee (#436)
- marketingFee = _marketingFee (#437)
- buybackFee = _buybackFee (#438)
- totalFee = _liquidityFee.add(_marketingFee).add(_buybackFee) (#439)
- feeDenominator = _feeDenominator (#440)
Winky.setSellMultiplier(uint256) (#457-459) should emit an event for:
- _sellMultiplier = multiplier (#458)
Winky.setTxLimit(uint256) (#465-468) should emit an event for:
- _maxTxAmount = amountBuy (#466)
Emit an event for critical parameter changes.
Additional information: link
Auth.transferOwnership(address).adr (#124) lacks a zero-check on :
- owner = adr (#125)
Winky.setFeeReceiver(address,address)._marketingFeeReceiver (#460) lacks a zero-check on :
- marketingFeeReceiver = _marketingFeeReceiver (#461)
Winky.setFeeReceiver(address,address)._buybackFeeReceiver (#460) lacks a zero-check on :
- buybackFeeReceiver = _buybackFeeReceiver (#462)
Check that the address is not zero.
Additional information: link
Reentrancy in Winky._transferFrom(address,address,uint256) (#289-318):
External calls:
- swapBack() (#307)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#376-382)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
External calls sending eth:
- swapBack() (#307)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
State variables written after the call(s):
- launch() (#309)
- launchedAt = block.number (#426)
Reentrancy in Winky.constructor() (#235-255):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#237)
State variables written after the call(s):
- _allowances[address(this)][address(router)] = type()(uint256).max (#238)
- _balances[_owner] = _totalSupply (#253)
- isFeeExempt[msg.sender] = true (#241)
- isTimelockExempt[msg.sender] = true (#248)
- isTimelockExempt[DEAD] = true (#249)
- isTimelockExempt[address(this)] = true (#250)
- isTxLimitExempt[msg.sender] = true (#243)
- isTxLimitExempt[address(this)] = true (#244)
- isTxLimitExempt[routerAddress] = true (#245)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in Winky._transferFrom(address,address,uint256) (#289-318):
External calls:
- swapBack() (#307)
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#376-382)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
External calls sending eth:
- swapBack() (#307)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#345)
- amountReceived = takeFee(sender,recipient,amount) (#313)
- Transfer(sender,recipient,amountReceived) (#316)
Reentrancy in Winky.constructor() (#235-255):
External calls:
- pair = IDEXFactory(router.factory()).createPair(WBNB,address(this)) (#237)
Event emitted after the call(s):
- Transfer(address(0),_owner,_totalSupply) (#254)
Reentrancy in Winky.swapBack() (#365-406):
External calls:
- router.swapExactTokensForETHSupportingFeeOnTransferTokens(amountToSwap,0,path,address(this),block.timestamp) (#376-382)
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
External calls sending eth:
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
- router.addLiquidityETH{value: amountBNBLiquidity}(address(this),amountToLiquify,0,0,marketingFeeReceiver,block.timestamp) (#396-403)
Event emitted after the call(s):
- AutoLiquify(amountBNBLiquidity,amountToLiquify) (#404)
Apply the check-effects-interactions pattern.
Additional information: link
Winky._transferFrom(address,address,uint256) (#289-318) uses timestamp for comparisons
Dangerous comparisons:
- require(bool,string)(cooldownTimer[recipient] < block.timestamp,Please wait for 1min between two operations) (#304)
Avoid relying on block.timestamp.
Additional information: link
Winky.buyTokens(uint256,address) (#408-419) is never used and should be removed
Remove unused functions.
Additional information: link
Winky._maxTxAmount (#198) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 1) / 100
Winky._maxWalletSize (#199) is set pre-construction with a non-constant function or state variable:
- (_totalSupply * 2) / 100
Winky.swapThreshold (#226) is set pre-construction with a non-constant function or state variable:
- _totalSupply / 1000 * 3
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Pragma version^0.8.11 (#6) necessitates a version too recent to be trusted. Consider deploying with 0.6.12/0.7.6/0.8.7
solc-0.8.11 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.
Additional information: link
Low level call in Winky.swapBack() (#365-406):
- (MarketingSuccess) = address(marketingFeeReceiver).call{gas: 30000,value: amountBNBMarketing}() (#390)
- (BuyBackSuccess) = address(buybackFeeReceiver).call{gas: 30000,value: amountBNBbuyback}() (#392)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Variable Auth._intAddr (#71) is not in mixedCase
Function IDEXRouter.WETH() (#139) is not in mixedCase
Parameter Winky.tradingStatus(bool)._status (#351) is not in mixedCase
Parameter Winky.setFees(uint256,uint256,uint256,uint256)._liquidityFee (#435) is not in mixedCase
Parameter Winky.setFees(uint256,uint256,uint256,uint256)._marketingFee (#435) is not in mixedCase
Parameter Winky.setFees(uint256,uint256,uint256,uint256)._buybackFee (#435) is not in mixedCase
Parameter Winky.setFees(uint256,uint256,uint256,uint256)._feeDenominator (#435) is not in mixedCase
Parameter Winky.cooldownEnabled(bool,uint8)._status (#444) is not in mixedCase
Parameter Winky.cooldownEnabled(bool,uint8)._interval (#444) is not in mixedCase
Parameter Winky.setFeeReceiver(address,address)._marketingFeeReceiver (#460) is not in mixedCase
Parameter Winky.setFeeReceiver(address,address)._buybackFeeReceiver (#460) is not in mixedCase
Parameter Winky.setSwapBackSettings(bool,uint256)._enabled (#469) is not in mixedCase
Parameter Winky.setSwapBackSettings(bool,uint256)._amount (#469) is not in mixedCase
Parameter Winky.blacklistAddress(address,bool)._address (#474) is not in mixedCase
Parameter Winky.blacklistAddress(address,bool)._value (#474) is not in mixedCase
Parameter Winky.transferForeignToken(address)._token (#482) is not in mixedCase
Variable Winky.WBNB (#188) is not in mixedCase
Variable Winky.DEAD (#189) is not in mixedCase
Variable Winky.ZERO (#190) is not in mixedCase
Constant Winky._name (#193) is not in UPPER_CASE_WITH_UNDERSCORES
Constant Winky._symbol (#194) is not in UPPER_CASE_WITH_UNDERSCORES
Constant Winky._decimals (#195) is not in UPPER_CASE_WITH_UNDERSCORES
Variable Winky._totalSupply (#197) is not in mixedCase
Variable Winky._maxTxAmount (#198) is not in mixedCase
Variable Winky._maxWalletSize (#199) is not in mixedCase
Variable Winky._balances (#201) is not in mixedCase
Variable Winky._allowances (#202) is not in mixedCase
Variable Winky._sellMultiplier (#214) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Variable IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#144) is too similar to IDEXRouter.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#145)
Prevent variables from having similar names.
Additional information: link
authorize(address) should be declared external:
- Auth.authorize(address) (#95-97)
unauthorize(address) should be declared external:
- Auth.unauthorize(address) (#103-105)
transferOwnership(address) should be declared external:
- Auth.transferOwnership(address) (#124-128)
tradingStatus(bool) should be declared external:
- Winky.tradingStatus(bool) (#351-356)
cooldownEnabled(bool,uint8) should be declared external:
- Winky.cooldownEnabled(bool,uint8) (#444-447)
blacklistAddress(address,bool) should be declared external:
- Winky.blacklistAddress(address,bool) (#474-476)
transferForeignToken(address) should be declared external:
- Winky.transferForeignToken(address) (#482-486)
isOverLiquified(uint256,uint256) should be declared external:
- Winky.isOverLiquified(uint256,uint256) (#496-498)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts