<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the lastest version of contract `Antisnipe`, here are the centralized functions and their privileged roles in the contract:

- `setConfidant`: Adds an address as a confidant who can access privileged functions. Only the `owner` role account can call this function.
- `removeConfidant`: Removes an address as a confidant who can access privileged functions. Only the `owner` role account can call this function.
- `setAntisnipeBlocksNum`: Sets the number of blocks for which the anti-snipe mechanism is active. Only `confidant` role account can call this function.
- `setToken`: Sets the token address for the contract. Only `confidant` role account can call this function.
- `setStartBlock`: Sets the block number at which the anti-snipe mechanism will start. Only `confidant` role account can call this function.
- `setMaxSwapQuantity`: Sets the maximum swap quantity allowed during the anti-snipe mechanism. Only `confidant` role account can call this function.
- `setPancakePair`: Sets the PancakeSwap pair address for the contract. Only `confidant` role account can call this function.
- `setSnipersLim`: Sets the maximum number of snipers allowed during the anti-snipe mechanism. Only `confidant` role account can call this function.
- `setRandomModulus`: Sets the random modulus used during the anti-snipe mechanism. Only `confidant` role account can call this function.
- `setSniperStatus`: Sets the status of a given sniper address. Only `confidant` role account can call this function.
- `setRevokeWhitelist`: Sets the revoke whitelist flag for a given address. Only `confidant` role account can call this function.
- `revoke`: Revokes tokens from snipers and transfers them to the contract owner. Only `confidant` role account can call this function.
- `checkSniper`: Checks if a given transaction involves a sniper. Only `token` role account can call this function.

Any compromise to the privileged account may allow the hacker to take advantage of this authority.


Centralization Risks in Antisnipe.sol

The current implementation of the `checkSniper()` relies on an insecure method for generating random numbers using `randMod(randomModulus)`. Generating random numbers requires satisfying requirements such as predictability, fairness, and tamper-resistance. Using on-chain data (e.g., block.number, block.timestamp, etc.) or any subject inputs for generating random numbers can be subject to miner manipulation.

Risk of Weak Randomness in `checkSniper()`

The `checkSniper()` function has an `external` visibility modifier. However, the logic of this function is an internal utility function that is meant to be used within the contract itself to check certain conditions, so this function should only be called in specific functions, like `transfer` or `transferFrom` in token contract, or by a specific group of users. 

Unclear Access Modifier for the `checkSniper()`

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

### External call(s)
```solidity=96
                token.transferFrom(accountsToRevoke[i], msg.sender, token.balanceOf(accountsToRevoke[i]));
```

### State variables written after the call(s)
```solidity=99
        delete accountsToRevoke;
```



Potential Reentrancy Issue

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

```solidity=70
        pancakePair = value;
```
- `value` is not zero-checked before being used.



Missing Zero Address Validation

The return value of the transfer()/transferFrom() call is not checked.

```solidity=96
                token.transferFrom(accountsToRevoke[i], msg.sender, token.balanceOf(accountsToRevoke[i]));
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

State variables that never change should be declared as `constant` to save gas.

```solidity=32
    uint112 private bansStatesNum = 3;
```
- `bansStatesNum` should be declared `constant`.



State Variable Should Be Declared Constant

AntiSnipe

Antisnipe.sol

Random.sol

CLS GLOBAL is a prominent player in the world of cryptocurrencies, known for its expertise in marketing and market-making. It is dedicated to ensuring stability in the highly volatile crypto markets.

Leaderboards

Due Diligence Tools

Resources

KYC Status

Bug Bounty Program