Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)
YuanXiaoFestival.addLiquidity(uint256,uint256) (#748-761) sends eth to arbitrary user
Dangerous calls:
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Additional information: link
Reentrancy in YuanXiaoFestival._transfer(address,address,uint256) (#659-698):
External calls:
- swapAndLiquify(contractTokenBalance) (#682)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#682)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#685)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#693)
- finalAmount = takeFee(sender,recipient,amount) (#687-688)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#775)
Apply the check-effects-interactions pattern.
Additional information: link
Combination 1: Reentrancy vulnerabilities + Functions that send Ether to arbitraty destination. Usual for scams. May be justified by some complex mechanics (e.g. rebase, reflections). DYOR & manual audit are advised.
Contract ticker (YuanxiaoFestival) has length of 16 chars.
Not a direct threat, but may indicate unreliable intentions of developer.
YuanXiaoFestival.addLiquidity(uint256,uint256) (#748-761) ignores return value by uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
Ensure that all the return values of the function calls are used.
Additional information: link
YuanXiaoFestival.allowance(address,address).owner (#514) shadows:
- Ownable.owner() (#163-165) (function)
YuanXiaoFestival._approve(address,address,uint256).owner (#537) shadows:
- Ownable.owner() (#163-165) (function)
Rename the local variables that shadow another component.
Additional information: link
YuanXiaoFestival.setBuyTaxes(uint256,uint256,uint256) (#558-564) should emit an event for:
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyBurnFee) (#563)
YuanXiaoFestival.setSellTaxes(uint256,uint256,uint256) (#566-572) should emit an event for:
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellBurnFee) (#571)
YuanXiaoFestival.setDistributionSettings(uint256,uint256,uint256) (#574-580) should emit an event for:
- _marketingShare = newMarketingShare (#576)
- _burnShare = newBurnShare (#577)
- _totalDistributionShares = _liquidityShare.add(_marketingShare).add(newBurnShare) (#579)
YuanXiaoFestival.setMaxTxAmount(uint256) (#582-584) should emit an event for:
- _maxTxAmount = maxTxAmount (#583)
YuanXiaoFestival.setWalletLimit(uint256) (#594-596) should emit an event for:
- _walletMax = newLimit (#595)
YuanXiaoFestival.setNumTokensBeforeSwap(uint256) (#598-600) should emit an event for:
- minimumTokensBeforeSwap = newLimit (#599)
Emit an event for critical parameter changes.
Additional information: link
YuanXiaoFestival.setMarketingWalletAddress(address).newAddress (#602) lacks a zero-check on :
- marketingWalletAddress = address(newAddress) (#603)
Check that the address is not zero.
Additional information: link
Reentrancy in YuanXiaoFestival.changeRouterVersion(address) (#623-640):
External calls:
- newPairAddress = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#631-632)
State variables written after the call(s):
- isMarketPair[address(uniswapPair)] = true (#639)
- isWalletLimitExempt[address(uniswapPair)] = true (#638)
- uniswapPair = newPairAddress (#635)
- uniswapV2Router = _uniswapV2Router (#636)
Reentrancy in YuanXiaoFestival.constructor() (#465-492):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#469-470)
State variables written after the call(s):
- _allowances[address(this)][address(uniswapV2Router)] = _totalSupply (#473)
- _balances[_msgSender()] = _totalSupply (#490)
- _totalTaxIfBuying = _buyLiquidityFee.add(_buyMarketingFee).add(_buyBurnFee) (#478)
- _totalTaxIfSelling = _sellLiquidityFee.add(_sellMarketingFee).add(_sellBurnFee) (#479)
- isExcludedFromFee[owner()] = true (#475)
- isExcludedFromFee[address(this)] = true (#476)
- isMarketPair[address(uniswapPair)] = true (#488)
- isTxLimitExempt[owner()] = true (#485)
- isTxLimitExempt[address(this)] = true (#486)
- isWalletLimitExempt[owner()] = true (#481)
- isWalletLimitExempt[address(uniswapPair)] = true (#482)
- isWalletLimitExempt[address(this)] = true (#483)
- uniswapV2Router = _uniswapV2Router (#472)
Reentrancy in YuanXiaoFestival.swapAndLiquify(uint256) (#707-726):
External calls:
- swapTokensForEth(marketAmountForEth + liquidityAmountForEth) (#717)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarket) (#723)
- recipient.transfer(amount) (#620)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- _allowances[owner][spender] = amount (#541)
Reentrancy in YuanXiaoFestival.transferFrom(address,address,uint256) (#650-654):
External calls:
- _transfer(sender,recipient,amount) (#651)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
External calls sending eth:
- _transfer(sender,recipient,amount) (#651)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#652)
- _allowances[owner][spender] = amount (#541)
Apply the check-effects-interactions pattern.
Additional information: link
Reentrancy in YuanXiaoFestival._transfer(address,address,uint256) (#659-698):
External calls:
- swapAndLiquify(contractTokenBalance) (#682)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#682)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#776)
- finalAmount = takeFee(sender,recipient,amount) (#687-688)
- Transfer(sender,recipient,finalAmount) (#695)
Reentrancy in YuanXiaoFestival.constructor() (#465-492):
External calls:
- uniswapPair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this),_uniswapV2Router.WETH()) (#469-470)
Event emitted after the call(s):
- Transfer(address(0),_msgSender(),_totalSupply) (#491)
Reentrancy in YuanXiaoFestival.swapAndLiquify(uint256) (#707-726):
External calls:
- swapTokensForEth(marketAmountForEth + liquidityAmountForEth) (#717)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarket) (#723)
- recipient.transfer(amount) (#620)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#542)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
Reentrancy in YuanXiaoFestival.swapTokensForEth(uint256) (#728-746):
External calls:
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
Event emitted after the call(s):
- SwapTokensForETH(tokenAmount,path) (#745)
Reentrancy in YuanXiaoFestival.transferFrom(address,address,uint256) (#650-654):
External calls:
- _transfer(sender,recipient,amount) (#651)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp) (#737-743)
External calls sending eth:
- _transfer(sender,recipient,amount) (#651)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#542)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#652)
Apply the check-effects-interactions pattern.
Additional information: link
Address.isContract(address) (#95-104) uses assembly
- INLINE ASM (#102)
Address._functionCallWithValue(address,bytes,uint256,string) (#131-148) uses assembly
- INLINE ASM (#140-143)
Do not use evm assembly.
Additional information: link
Address._functionCallWithValue(address,bytes,uint256,string) (#131-148) is never used and should be removed
Address.functionCall(address,bytes) (#114-116) is never used and should be removed
Address.functionCall(address,bytes,string) (#118-120) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#122-124) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#126-129) is never used and should be removed
Address.isContract(address) (#95-104) is never used and should be removed
Address.sendValue(address,uint256) (#106-112) is never used and should be removed
Context._msgData() (#22-25) is never used and should be removed
SafeMath.mod(uint256,uint256) (#83-85) is never used and should be removed
SafeMath.mod(uint256,uint256,string) (#87-90) is never used and should be removed
Remove unused functions.
Additional information: link
YuanXiaoFestival._totalSupply (#427) is set pre-construction with a non-constant function or state variable:
- 10 * 10 ** 8 * 10 ** _decimals
YuanXiaoFestival._maxTxAmount (#428) is set pre-construction with a non-constant function or state variable:
- 10 * 10 ** 8 * 10 ** _decimals
YuanXiaoFestival._walletMax (#429) is set pre-construction with a non-constant function or state variable:
- 10 * 10 ** 8 * 10 ** _decimals
YuanXiaoFestival.minimumTokensBeforeSwap (#430) is set pre-construction with a non-constant function or state variable:
- 1 * 10 ** 3 * 10 ** _decimals
Remove any initialization of state variables via non-constant state variables or function calls. If variables must be set upon contract deployment, locate initialization in the constructor instead.
Additional information: link
Low level call in Address.sendValue(address,uint256) (#106-112):
- (success) = recipient.call{value: amount}() (#110)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#131-148):
- (success,returndata) = target.call{value: weiValue}(data) (#134)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence
Additional information: link
Function IUniswapV2Pair.DOMAIN_SEPARATOR() (#221) is not in mixedCase
Function IUniswapV2Pair.PERMIT_TYPEHASH() (#222) is not in mixedCase
Function IUniswapV2Pair.MINIMUM_LIQUIDITY() (#238) is not in mixedCase
Function IUniswapV2Router01.WETH() (#257) is not in mixedCase
Parameter YuanXiaoFestival.setSwapAndLiquifyEnabled(bool)._enabled (#606) is not in mixedCase
Variable YuanXiaoFestival._balances (#402) is not in mixedCase
Variable YuanXiaoFestival._buyLiquidityFee (#411) is not in mixedCase
Variable YuanXiaoFestival._buyMarketingFee (#412) is not in mixedCase
Variable YuanXiaoFestival._buyBurnFee (#413) is not in mixedCase
Variable YuanXiaoFestival._sellLiquidityFee (#415) is not in mixedCase
Variable YuanXiaoFestival._sellMarketingFee (#416) is not in mixedCase
Variable YuanXiaoFestival._sellBurnFee (#417) is not in mixedCase
Variable YuanXiaoFestival._liquidityShare (#419) is not in mixedCase
Variable YuanXiaoFestival._marketingShare (#420) is not in mixedCase
Variable YuanXiaoFestival._burnShare (#421) is not in mixedCase
Variable YuanXiaoFestival._totalTaxIfBuying (#423) is not in mixedCase
Variable YuanXiaoFestival._totalTaxIfSelling (#424) is not in mixedCase
Variable YuanXiaoFestival._totalDistributionShares (#425) is not in mixedCase
Variable YuanXiaoFestival._maxTxAmount (#428) is not in mixedCase
Variable YuanXiaoFestival._walletMax (#429) is not in mixedCase
Variable YuanXiaoFestival._isBlacklisted (#440) is not in mixedCase
Follow the Solidity naming convention.
Additional information: link
Redundant expression "this (#23)" inContext (#16-26)
Remove redundant statements if they congest code but offer no value.
Additional information: link
Reentrancy in YuanXiaoFestival._transfer(address,address,uint256) (#659-698):
External calls:
- swapAndLiquify(contractTokenBalance) (#682)
- recipient.transfer(amount) (#620)
External calls sending eth:
- swapAndLiquify(contractTokenBalance) (#682)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- _balances[sender] = _balances[sender].sub(amount,Insufficient Balance) (#685)
- _balances[recipient] = _balances[recipient].add(finalAmount) (#693)
- finalAmount = takeFee(sender,recipient,amount) (#687-688)
- _balances[address(this)] = _balances[address(this)].add(feeAmount) (#775)
Event emitted after the call(s):
- Transfer(sender,address(this),feeAmount) (#776)
- finalAmount = takeFee(sender,recipient,amount) (#687-688)
- Transfer(sender,recipient,finalAmount) (#695)
Reentrancy in YuanXiaoFestival.swapAndLiquify(uint256) (#707-726):
External calls:
- transferToAddressETH(marketingWalletAddress,amountBNBMarket) (#723)
- recipient.transfer(amount) (#620)
External calls sending eth:
- transferToAddressETH(marketingWalletAddress,amountBNBMarket) (#723)
- recipient.transfer(amount) (#620)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
- _allowances[owner][spender] = amount (#541)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#542)
- addLiquidity(otherhalf,amountBNBLiquid) (#725)
Reentrancy in YuanXiaoFestival.transferFrom(address,address,uint256) (#650-654):
External calls:
- _transfer(sender,recipient,amount) (#651)
- recipient.transfer(amount) (#620)
External calls sending eth:
- _transfer(sender,recipient,amount) (#651)
- recipient.transfer(amount) (#620)
- uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,owner(),block.timestamp) (#753-760)
State variables written after the call(s):
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#652)
- _allowances[owner][spender] = amount (#541)
Event emitted after the call(s):
- Approval(owner,spender,amount) (#542)
- _approve(sender,_msgSender(),_allowances[sender][_msgSender()].sub(amount,ERC20: transfer amount exceeds allowance)) (#652)
Apply the check-effects-interactions pattern.
Additional information: link
Variable IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountADesired (#262) is too similar to IUniswapV2Router01.addLiquidity(address,address,uint256,uint256,uint256,uint256,address,uint256).amountBDesired (#263)
Prevent variables from having similar names.
Additional information: link
YuanXiaoFestival.slitherConstructorVariables() (#390-783) uses literals with too many digits:
- deadAddress = 0x000000000000000000000000000000000000dEaD (#400)
Use: Ether suffix, Time suffix, or The scientific notation
Additional information: link
Ownable._previousOwner (#153) is never used in YuanXiaoFestival (#390-783)
Remove unused state variables.
Additional information: link
Ownable._previousOwner (#153) should be constant
YuanXiaoFestival._decimals (#397) should be constant
YuanXiaoFestival._name (#395) should be constant
YuanXiaoFestival._symbol (#396) should be constant
Add the constant attributes to state variables that never change.
Additional information: link
waiveOwnership() should be declared external:
- Ownable.waiveOwnership() (#172-175)
transferOwnership(address) should be declared external:
- Ownable.transferOwnership(address) (#177-181)
getTime() should be declared external:
- Ownable.getTime() (#184-186)
name() should be declared external:
- YuanXiaoFestival.name() (#494-496)
symbol() should be declared external:
- YuanXiaoFestival.symbol() (#498-500)
decimals() should be declared external:
- YuanXiaoFestival.decimals() (#502-504)
totalSupply() should be declared external:
- YuanXiaoFestival.totalSupply() (#506-508)
allowance(address,address) should be declared external:
- YuanXiaoFestival.allowance(address,address) (#514-516)
increaseAllowance(address,uint256) should be declared external:
- YuanXiaoFestival.increaseAllowance(address,uint256) (#518-521)
decreaseAllowance(address,uint256) should be declared external:
- YuanXiaoFestival.decreaseAllowance(address,uint256) (#523-526)
minimumTokensBeforeSwapAmount() should be declared external:
- YuanXiaoFestival.minimumTokensBeforeSwapAmount() (#528-530)
approve(address,uint256) should be declared external:
- YuanXiaoFestival.approve(address,uint256) (#532-535)
setMarketPairStatus(address,bool) should be declared external:
- YuanXiaoFestival.setMarketPairStatus(address,bool) (#545-547)
setIsExcludedFromFee(address,bool) should be declared external:
- YuanXiaoFestival.setIsExcludedFromFee(address,bool) (#553-555)
setSwapAndLiquifyEnabled(bool) should be declared external:
- YuanXiaoFestival.setSwapAndLiquifyEnabled(bool) (#606-609)
setSwapAndLiquifyByLimitOnly(bool) should be declared external:
- YuanXiaoFestival.setSwapAndLiquifyByLimitOnly(bool) (#611-613)
getCirculatingSupply() should be declared external:
- YuanXiaoFestival.getCirculatingSupply() (#615-617)
changeRouterVersion(address) should be declared external:
- YuanXiaoFestival.changeRouterVersion(address) (#623-640)
transfer(address,uint256) should be declared external:
- YuanXiaoFestival.transfer(address,uint256) (#645-648)
transferFrom(address,address,uint256) should be declared external:
- YuanXiaoFestival.transferFrom(address,address,uint256) (#650-654)
Use the external attribute for functions never called from the contract.
Additional information: link
Unable to find website, listings and other project-related information
Young tokens have high risks of scam / price dump / death
Token has no active CoinGecko listing / rank
Token has no active CoinMarketCap listing / rank
Unable to find Telegram and Twitter accounts