<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

PancakeSwap

In the contract `Token` the role `_owner` has authority over the functions shown in the diagram below.

 - `setPair()` and `_setPair()`: Manage the usage status of pairs in this contract. The owner can add new pairs, or disable an active pair. 
 - `setBuyTaxes()`: Set the fee rate when users get the `LLFR2` token from a pair.
 - `setSellTaxes()`: Set the fee rate when users use the `LLFR2` token to get other tokens from a pair.
 - `setLPThreshold()`: Set the value of the state variable `lpThreshold`. Transactions with the pair will accumulate `lp` fee, once the `lp` fee meets the `lpThreshold`, the contract will use all of the `lp` fees to add liquidity to the `LLFR2-WBNB` pair
 - `setMarketingThreshold()`: Set the value of the state variable `marketingThreshold`.
 - `setMarketingSwap()`: Set the value of the state variable `isSwap`. When the `isSwap` is true, the contract will swap all of the market fees to BNB.
 - `excludeFromFees()`: Manage the addresses that don't need to pay transaction fees.
 - `withdrawBNB()`: Withdraw the BNBs swapped from the market fees.
 - `withdrawMarketingTokens()`: Withdraw the `LLFR2`s that earned from the market fees.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/9f83256a82cb4cfdb4791de25637bbbf/diagrams/centralization_Token-Token-_owner.svg)

Centralization Risks in Token.sol

In the contract `Token`, the EOA address `owner` has `100000000000000 * 10 ** decimals()` tokens minted at the time of the contract deployment, which has severe centralization risk and can manipulate the tokenomics of the project.
```solditiy=53
    constructor(address _router) ERC20("LLFR2", "LLFR2") {
        _mint(msg.sender, 100000000000000 * 10 ** decimals());
```

Also, the contract will use a part of the transaction fee to add liquidity, but the LP tokens are transferred to the EOA address `owner`, this contract logic results in a centralized token holding position over time.
```solidity=94
    function addLiquidity(uint256 tokenAmount, uint256 bnbAmount) private {
        _approve(address(this), address(uniswapV2Router), tokenAmount);
        
        uniswapV2Router.addLiquidityETH{value: bnbAmount}(
            address(this),
            tokenAmount,
            0,
            0,
            owner(),
            block.timestamp
        );
    }
```

Any compromise to the private keys of the `owner` EOA address may allow a hacker to take advantage of the EOA address authority and sell tokens on the market and/or remove the pool liquidity, causing a severe price drop.

Centralized Token Holding Position Risk

`if` branches in lines 187 and 199 have the same logic issue.

If the execution steps into the `if` branch in line 187, the fee `lpAmount` will not be added to the state variable `lpCurrentAmount`, and this contract can not receive the `lp` fee.

Similarly, if the execution steps into the `if` branch in line 199, the fee `marketingAmount` will not be added to the state variable `marketingCurrentAmount`, and this contract can not receive the `marketing` fee.

```solidity=185
                if (sellFees.lp > 0) {
                    uint256 lpAmount = remainingAmount.mul(sellFees.lp).div(100);
                    if (lpThreshold != 0 && (lpCurrentAmount.add(lpAmount) >= lpThreshold)) {
                        swapAndLiquify(lpCurrentAmount);
                        lpCurrentAmount = 0;  // Reset the lpCurrentAmount to 0 after swapAndLiquify is called
                        remainingAmount = remainingAmount.sub(lpAmount);
                    } else {
                        lpCurrentAmount = lpCurrentAmount.add(lpAmount);
                        remainingAmount = remainingAmount.sub(lpAmount);
                        super._transfer(from, address(this), lpAmount);
                    }
                }
                if (sellFees.marketing > 0) {
                    uint256 marketingAmount = remainingAmount.mul(sellFees.marketing).div(100);
                    if (isSwap && marketingThreshold != 0 && (marketingCurrentAmount.add(marketingAmount) >= marketingThreshold)) {
                        _swapTokensForBNBSimple(marketingCurrentAmount);
                        marketingCurrentAmount = 0; // Reset the marketingCurrentAmount to 0 because all tokens have been swapped
                        remainingAmount = remainingAmount.sub(marketingAmount);
                    } else {
                        marketingCurrentAmount = marketingCurrentAmount.add(marketingAmount);
                        remainingAmount = remainingAmount.sub(marketingAmount);
                        super._transfer(from, address(this), marketingAmount);
                    }
                }
```

Logic Issue In The Function `_transfer()`

The state variable `_inSwapAndLiquify` is not used in any validation logic, therefore the modifier `lockTheSwap` can't move as an execution lock.

Logic Issue in The Modifier `lockTheSwap`

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by back running (executing after the target) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount. Hence, transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large :

- `addLiquidity()`
- `_swapTokensForBNB()`
- `_swapTokensForBNBSimple()`

Potential Sandwich Attacks

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

Froggies Token

Token.sol

CertiK KYC

CertiK Skynet

Froggies Token is a deflationary meme token that focuses primarily on providing its investors and community with use-case, utility and fun.

Leaderboards

Due Diligence Tools

Resources

Bug Bounty Program