<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

transfer

transferFrom

totalSupply

balanceOf

allowance

approve

DividendPayingToken

ERC20

LilFloki

LilFlokiDividendTracker

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

### External call(s)
```solidity=94
      (bool success,) = user.call{value: _withdrawableDividend, gas: 3000}("");
```

### State variables written after the call(s)
```solidity=97
        withdrawnDividends[user] = withdrawnDividends[user].sub(_withdrawableDividend);
```


---
### External call(s)
```solidity=360
            swapAndLiquify(swapTokens);
```
* This function call executes the following external call(s).
* In `LilFloki.addLiquidity`,
    * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)`
* In `LilFloki.swapTokensForEth`,
    * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)`

```solidity=363
            sendBNBToMarketing(marketingTokens);
```

```solidity=366
            swapAndSendDividends(sellTokens);
```
* This function call executes the following external call(s).
* In `LilFloki.swapAndSendDividends`,
    * `(success) = address(dividendTracker).call{value: dividends}("")`
* In `LilFloki.sendBNBToMarketing`,
    * `_marketingWallet.transfer(bnbToSend)`

### State variables written after the call(s)
```solidity=368
            swapping = false;
```

```solidity=389
            super._transfer(from, address(this), fees);
```
* This function call executes the following assignment(s).
* In `ERC20._transfer`,
    * `_balances[sender] = _balances[sender].sub(amount,"ERC20: transfer amount exceeds balance")`
* In `ERC20._transfer`,
    * `_balances[recipient] = _balances[recipient].add(amount)`

```solidity=392
        super._transfer(from, to, amount);
```
* This function call executes the following assignment(s).
* In `ERC20._transfer`,
    * `_balances[sender] = _balances[sender].sub(amount,"ERC20: transfer amount exceeds balance")`
* In `ERC20._transfer`,
    * `_balances[recipient] = _balances[recipient].add(amount)`


---
### External call(s)
```solidity=663
    			if(processAccount(payable(account), true)) {
```
* This function call executes the following external call(s).
* In `DividendPayingToken._withdrawDividendOfUser`,
    * `(success) = user.call{gas: 3000,value: _withdrawableDividend}("")`

### State variables written after the call(s)
```solidity=679
    	lastProcessedIndex = _lastProcessedIndex;
```



Potential Reentrancy Issue (Sending ETH or Tokens)

There are no upper boundaries for `BNBRewardsFee`, `liquidityFee`, and `marketingFee` which are set in `setFee()`. It is possible to set the total fee rates up to any arbitrary amount, which will potentially lead to an unexpected result or miscalculation of the fees.

No Upper Limit in `setFee()` function

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

*This finding is considered minor because the state variable is only incremented or decremented. So, the effect of out-of-order increments may be unobservable after transaction. However, the reentrancy vulnerability may still cause other issues in the middle of transaction.*

### External call(s)
```solidity=360
            swapAndLiquify(swapTokens);
```
* This function call executes the following external call(s).
* In `LilFloki.addLiquidity`,
    * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)`
* In `LilFloki.swapTokensForEth`,
    * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)`

```solidity=363
            sendBNBToMarketing(marketingTokens);
```

### State variables written after the call(s)
```solidity=363
            sendBNBToMarketing(marketingTokens);
```
* This function call executes the following assignment(s).
* In `ERC20._approve`,
    * `_allowances[owner][spender] = amount`


---
### External call(s)
```solidity=360
            swapAndLiquify(swapTokens);
```
* This function call executes the following external call(s).
* In `LilFloki.addLiquidity`,
    * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)`
* In `LilFloki.swapTokensForEth`,
    * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)`

```solidity=363
            sendBNBToMarketing(marketingTokens);
```

```solidity=366
            swapAndSendDividends(sellTokens);
```
* This function call executes the following external call(s).
* In `LilFloki.swapAndSendDividends`,
    * `(success) = address(dividendTracker).call{value: dividends}("")`

### State variables written after the call(s)
```solidity=366
            swapAndSendDividends(sellTokens);
```
* This function call executes the following assignment(s).
* In `ERC20._approve`,
    * `_allowances[owner][spender] = amount`


---
### External call(s)
```solidity=421
        swapTokensForEth(half); // <- this breaks the ETH -> HATE swap when swap+liquify is triggered
```
* This function call executes the following external call(s).
* In `LilFloki.swapTokensForEth`,
    * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)`

```solidity=427
        addLiquidity(otherHalf, newBalance);
```
* This function call executes the following external call(s).
* In `LilFloki.addLiquidity`,
    * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)`

### State variables written after the call(s)
```solidity=427
        addLiquidity(otherHalf, newBalance);
```
* This function call executes the following assignment(s).
* In `ERC20._approve`,
    * `_allowances[owner][spender] = amount`


---
### External call(s)
```solidity=685
        uint256 amount = _withdrawDividendOfUser(account);
```
* This function call executes the following external call(s).
* In `DividendPayingToken._withdrawDividendOfUser`,
    * `(success) = user.call{gas: 3000,value: _withdrawableDividend}("")`

### State variables written after the call(s)
```solidity=688
    		lastClaimTimes[account] = block.timestamp;
```



Potential Reentrancy Issue (Incrementing State)


```solidity=566
                iterationsUntilProcessed = index.sub(int256(lastProcessedIndex));
```
- The type conversion `int256(lastProcessedIndex)` from type uint256 to type int256 may flip the value's sign.


---
```solidity=574
                iterationsUntilProcessed = index.add(int256(processesUntilEndOfArray));
```
- The type conversion `int256(processesUntilEndOfArray)` from type uint256 to type int256 may flip the value's sign.




Unsafe Integer Cast

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

```solidity=161
        _marketingWallet = wallet;
```
- `wallet` is not zero-checked before being used.



Missing Zero Address Validation

The return value of an external call is not stored in a local or state variable.

```solidity=293
		dividendTracker.processAccount(msg.sender, false);
```


---
```solidity=459
        uniswapV2Router.addLiquidityETH{value: ethAmount}(
            address(this),
            tokenAmount,
            0, // slippage is unavoidable
            0, // slippage is unavoidable
            liquidityWallet,
            block.timestamp
        );
```



Unused Return Value

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation.

```solidity=474
         _marketingWallet.transfer(bnbToSend);
```
- `LilFloki.sendBNBToMarketing` uses `transfer()`.


Usage of `transfer`/`send` for sending Ether

Minor typo

State variables that never change should be declared as `constant` to save gas.

```solidity=30
    uint256 public swapTokensAtAmount = 200000000 * (10**18);
```
- `swapTokensAtAmount` should be declared `constant`.



State Variable Should Be Declared Constant

One or more state variables are never used in the codebase.

Variable `MAX_INT256` in `SafeMathInt` is never used in `SafeMathInt`.

```solidity=36
    int256 private constant MAX_INT256 = ~(int256(1) << 255);
```

```solidity=34
library SafeMathInt {
```



Unused State Variable

Given the require(false) statement, the code block from line 148 to line 150 will never be executed and is unnecessary. 

``` solidity=145
function _transfer(address from, address to, uint256 value) internal virtual override {
    require(false);

    int256 _magCorrection = magnifiedDividendPerShare.mul(value).toInt256Safe();
    magnifiedDividendCorrections[from] = magnifiedDividendCorrections[from].add(_magCorrection);
    magnifiedDividendCorrections[to] = magnifiedDividendCorrections[to].sub(_magCorrection);
  }
```

Unreachable code 

The return values of functions swapExactTokensForETHSupportingFeeOnTransferTokens and addLiquidityETH are not properly handled. 

Return value not properly handled

lil floki

Context.sol

DividendPayingToken.sol

DividendPayingTokenInterface.sol

DividendPayingTokenOptionalInterface.sol

ERC20.sol

IERC20.sol

IERC20Metadata.sol

IUniswapV2Factory.sol

IUniswapV2Pair.sol

IUniswapV2Router.sol

IterableMapping.sol

LilFloki.sol

Ownable.sol

SafeMath.sol

SafeMathInt.sol

SafeMathUint.sol

Bringing together crypto + gaming + animal rescue, Lil Floki is a token that stemmed from the idea of assisting Dog shelters in New Zealand during the covid pandemic, it has since evolved into a global project helping Dog shelters worldwide. The iconic character Lil Floki is inspired upon Elon Musk’s own Shiba Inu dog.

Leaderboards

Due Diligence Tools

Resources

KYC Status

Bug Bounty Program