<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

FamilyToken V2

transfer

transferFrom

totalSupply

balanceOf

allowance

approve

FamilyTokenV2

Requiring `msg.sender == tx.origin` breaks the interaction with other contracts

`excludeFromReward()`/`includeInReward()` implementation is bad

`transferAnyERC20Token()` allows to extract all the tokens including `FT-2` and `BUSD`

Centralization Risks in FamilyTokenV2.sol

`unlock()` can't be called if it was not scheduled before calling `lock()`

`transferFrom()` is not protected by `nonReentrant` modifier

`includeInFee()` uses wrong `_schedules[FuncId.includeInReward]`

`setRouterAddress()` doesn't allow to change the router if the pairs were already created

`_isExcluded()` is never used

Ownership can be restored after renouncing or transferring

Part of the Liquidity Fees Can Be Stolen via Flashloan Attack on `_swapAndLiquify()`

Redundant `approve()` in `_transferFeesToWallets()`

Potential Reentrancy Attack

Contract business logic and time-lock are implemented in the same contract

`setPenaltyMaxSellBalanceWithoutPenalty()` implements upper bound on `penaltyMaxSellBalanceWithoutPenalty`

`setPenalty` functions don't check the total `penaltyFee` value

Incorrect ERC-20 Interface

Unchecked ERC-20 `transfer()`/`transferFrom()` Call

Unused Return Value

Missing Zero Address Validation

No Upper Limits for Fees

Incorrect event emitted in `lock()`

Improper Update For Router Address

Transferring of zero amount is not allowed

Contract gains extra BUSD via the `_swapAndLiquify()` function

Unnecessary Fallback Function

`accounts[_sender].sell` can grow without limit

`_swapAndLiquify()` condition is unclear

State Variable Should Be Declared Constant

Variables That Could Be Declared as Immutable

External call to `address(this)`

Time units can be used instead of `TWO_DAYS`

Unused Events

Redundant Statements

Crypto Family

FamilyTokenV2.sol

CertiK KYC

CertiK Skynet

Top 10% Watchlisted

Top 10% Code Security Score

Assist everyone on the planet in achieving financial freedom, regardless of their expertise of the blockchain technology.

Crypto Family 

Crypto Family Token v2 bsc

Leaderboards

Due Diligence Tools

Resources

Bug Bounty Program