<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

In the contract `ECO` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set fees, enable or disable token transfer, exclude transaction limits for wallets, exclude fees for wallets, set the fee amount that will be swapped for ETH, enable or disable transaction limits, enable or disable transaction fees, change `walletOfFund` address, set Merkle root for partner wallets, and withdraw ETH from the `ECO` contract.
![](https://accelerator-tasks-prod.s3.amazonaws.com/b9b3086383a9473992d6a9875ef59d20/diagrams/centralization_ECO-ECO-_owner.svg)

Centralization Risks in ECO.sol

In the function `mintForPartners()`, the unit of input parameter `amount` is `ether`, the maximum number of tokens that can be minted for partners cannot exceed `mintableTokenAmountForPartners`, whose unit is `wei`.

```solidity=478
        require(
            amount <= mintableTokenAmountForPartners,
            "Required amount is over of mintable amount."
        );
```

The `require` statement does not multiply the `amount` by `1e18`, resulting in minting an excess token amount still pass the check.

This issue also exists in `privateSale()` and `publicSale()` functions.

Incorrect check on the number of tokens available for sale

The mapping `automatedMarketMakerPairs` is an empty map because it is never initiated. So, the following condition is always evaluated to false, and the `swapTokenAndSendEthToWallet()` function will not be called. As a result, all fees are locked in the `ECO` contract.

```solidity=211
        if (canSwap && !swapping && automatedMarketMakerPairs[to]) {
```
 

Map `automatedMarketMakerPairs` is not initiated

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

```solidity=534
        payable(ownerWallet).transfer(address(this).balance);
```
- `ownerWallet` is not zero-checked before being used.



Missing Zero Address Validation

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation.

```solidity=534
        payable(ownerWallet).transfer(address(this).balance);
```
- `ECO.withdraw` uses `transfer()`.


Usage of `transfer`/`send` for sending Ether

The `ECO` contract approves the `uniswapV2Router` address for an unlimited number of tokens. This can be a security risk if the router contract is compromised.

 Grant an unlimited amount of tokens to the router address

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

```solidity=13
    using SafeMath for uint256;
```
- `SafeMath` library is used for `uint256` type in `ECO` contract.



Unnecessary Use of SafeMath

State variables that never change should be declared as `constant` to save gas.

```solidity=43
    uint public mintableTokenAmountForFounders =
        (INIT_TOTAL_SUPPLY * SHARE_OF_FOUNDERS) / 1000;
```
- `mintableTokenAmountForFounders` should be declared `constant`.


---
```solidity=59
    uint public tokenPriceForPartners = 0.00002 ether;
```
- `tokenPriceForPartners` should be declared `constant`.


---
```solidity=60
    uint public tokenPriceForPrivate = 0.00003 ether;
```
- `tokenPriceForPrivate` should be declared `constant`.


---
```solidity=61
    uint public tokenPriceForPublic = 0.00004 ether;
```
- `tokenPriceForPublic` should be declared `constant`.


---
```solidity=71
    address public walletOfFounder1 =
        0xF9e347F9837A07c3b0778011Db4720E252B7b6a0;
```
- `walletOfFounder1` should be declared `constant`.


---
```solidity=73
    address public walletOfFounder2 =
        0x21E41D5efC9A5FC24D7212A0151Bb18983c79Dc4;
```
- `walletOfFounder2` should be declared `constant`.


---
```solidity=75
    address public walletOfFounder3 =
        0x56F877f0bF4f8502c29afa4474692F8219C98bef;
```
- `walletOfFounder3` should be declared `constant`.


---
```solidity=79
    address public walletOfEcosystem =
        0xe0FcFd2a0aFE8c9F3707Beb34291C518D2FC00Cf;
```
- `walletOfEcosystem` should be declared `constant`.


---
```solidity=81
    address public walletOfCommunity =
        0xbe3a59FD4Cbed7D850f1F622F788Bf16c8CA4bDa;
```
- `walletOfCommunity` should be declared `constant`.


---
```solidity=83
    address public walletOfListing = 0x89B3Fe584e4Ea44115fFcA6DD41B6621DF8c37EC;
```
- `walletOfListing` should be declared `constant`.


---
```solidity=84
    address public walletOfMarketing =
        0x39FC2c432cA5098301a97817aF894d75685bc496;
```
- `walletOfMarketing` should be declared `constant`.


---
```solidity=89
    address private walletOfBurn = 0x000000000000000000000000000000000000dEaD;
```
- `walletOfBurn` should be declared `constant`.



State Variable Should Be Declared Constant

If `maxTransactionLimitEnabled` is enabled and wallets are not excluded from the maximum transaction limit, then transfers of tokens between user wallets must also follow maximum transfer limits, and the token amount cannot exceed the value returned by the `maxTransferAmountSell()` function.

As the name of the `maxTransferAmountSell()` function implies, it is intended for selling transactions but not wallet-to-wallet token transfers. 


Maximum transaction limit applies to token transfer

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The comment states "Max buy fee is 20% and max sell fee is 30%". However, the maximum buy fee is 2% and the maximum sale fee is 3%.

Inconsistent Comment and Code

The mintable token amount cannot exceed the maximum value of `uint` type, making the use of `MAX_SUPPLY` redundant.

```solidity=19
    uint public constant MAX_SUPPLY = type(uint).max;
```

Constant `MAX_SUPPLY` is redundant

Greenplaneteco - Audit

ECO.sol

CertiK KYC

Green Planet Eco is a new environmental company that has recently started with a mission to promote sustainability and protect the environment through innovative solutions. The company’s vision is to create a world where natural resources are used responsibly, and people work in harmony with nature to ensure a healthy and sustainable future.


Leaderboards

Due Diligence Tools

Resources

Bug Bounty Program