<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

transfer

transferFrom

totalSupply

balanceOf

allowance

approve

AntiBotLiquidityGeneratorToken

In the contract `AntiBotLiquidityGeneratorToken` the role `_owner` has authority over the functions shown in the diagram below.
![](https://accelerator-tasks-prod.s3.amazonaws.com/a5060626835449c5ac6cd9c93a0fd0c9/diagrams/centralization_AntiBotLiquidityGeneratorToken-AntiBotLiquidityGeneratorToken-_owner.svg)
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and:
- function excludeFromFee(): exclude addresses from paying fees.
- function excludeFromReward(): exclude addresses from reward(reflect mechanism).
- function includeInReward(): include addresses for reward(reflect mechanism).
- function setTaxFeePercent(): set tax fee percent.
- function setLiquidityFeePercent(): set liquidity fee percent.
- function setCharityFeePercent(): set charity fee percent.
- function setSwapBackSettings(): change the value of `numTokensSellToAddToLiquidity`(swap threshold).
- function setEnableAntiBot(): change the value of `enableAntiBot` which controls whether to call a third-party anti-bot checker before token transfer.

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.
![](https://accelerator-tasks-prod.s3.amazonaws.com/a5060626835449c5ac6cd9c93a0fd0c9/diagrams/centralization_AntiBotLiquidityGeneratorToken-Ownable-_owner.svg)
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and:
- function transferOwnership(): transfer the `_owner` role to another account.
- function renounceOwnership(): change the `_owner` address to address(0). 

Centralization Risks in AntiBotLiquidityGeneratorToken.sol

All initial `PEPA` tokens are sent to the address `_owner` by the following statement when deploying the contract. This is a potential centralization risk as the deployer can distribute `Golteum` tokens without the consensus of the community. 

```solidity=1042
  _rOwned[owner()] = _rTotal;
```

Initial Token Distribution

```solidity
    function includeInReward(address account) external onlyOwner() {
        require(_isExcluded[account], "Account is already included");
        for (uint256 i = 0; i < _excluded.length; i++) {
            if (_excluded[i] == account) {
                _excluded[i] = _excluded[_excluded.length - 1];
                _tOwned[account] = 0;
                _isExcluded[account] = false;
                _excluded.pop();
                break;
            }
        }
    }
```
Variable `_rOwned[account]` is not updated in the function `includeInReward()`, which will make the accounts included siphon off the tokens out of the balances of all token holders.
 
The Rate was higher at the moment of the `excludeFromReward(account)` call, so the `_rOwned[account] / _tOwned[account]` ratio is bigger than expected for accounts included in the reward.

Variable `_rOwned[account]` Not Updated in Function `includeInReward()`

The `swapAndLiquify()` function converts half of the `Pepa` tokens to BNB. The other half of `Pepa` tokens and part of the converted BNB are deposited into the pool on Pancakeswap as liquidity. For every `swapAndLiquify()` function call, a small amount of BNB is left over in the contract. This is because the price of `Pepa` drops after swapping the first half into BNB, and the other half of `Pepa` require less than the converted BNB to be paired with it when adding liquidity. The contract does not appear to provide a way to withdraw those `Pepa`, and they will be locked in the contract forever.  

Contract gains non-withdrawable BNB via the `swapAndLiquify()` function

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. 

```solidity=1065
        payable(serviceFeeReceiver_).transfer(serviceFee_);
```
- `serviceFeeReceiver_` is not zero-checked before being used.



Missing Zero Address Validation

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. 

```solidity=1065
        payable(serviceFeeReceiver_).transfer(serviceFee_);
```
- `AntiBotLiquidityGeneratorToken.constructor` uses `transfer()`.


Usage of `transfer`/`send` for sending Ether

When the contract is deployed the following addresses are exempted from fees:
- the address `_owner`

If ownership is transferred or renounced with `transferOwnership()` or `renounceOwnership()`, the exemptions are not granted to the new owner nor are they revoked from the previous owner.

Privilege not Revoked or Transferred

The error message in the function `includeInReward()` does not describe the error correctly.

```solidity=1225
  require(_isExcluded[account], "Account is already excluded")
```

Incorrect error message

The function `constructor()` is payable and sends an arbitrary amount of Ether to an arbitrary address(`serviceFeeReceiver_`). The destination `serviceFeeReceiver_` and Ether amount `serviceFee_` are both passed in as inputs. We want to confirm with the client the purpose of this implementation.

```solidity=1065
    payable(serviceFeeReceiver_).transfer(serviceFee_);
```

Sending Ether to Arbitrary Destinations

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

```solidity=201
library SafeMath {
```
- An implementation of `SafeMath` library is found.


---
```solidity=934
    using SafeMath for uint256;
```
- `SafeMath` library is used for `uint256` type in `AntiBotLiquidityGeneratorToken` contract.

```solidity=1038
        numTokensSellToAddToLiquidity = totalSupply_.div(10**3); // 0.1%
```
- `SafeMath.div` is called in `constructor` function of `AntiBotLiquidityGeneratorToken` contract.

*Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 54) are shown above.*



Unnecessary Use of SafeMath

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

The function `deliver()` can be called by anyone. It accepts an uint256 number parameter `tAmount`. The function reduces the METT token balance of the caller by `rAmount`, which is `tAmount` reduces the transaction fee. Then, the function adds `tAmount` to variable `_tFeeTotal`, which represents the contract's total transaction fee. We wish the team could explain more on the purpose of having such functionality.

The purpose of function `deliver`

Generally, deflationary tokens are incompatible with DEX and special rules need to be coded for DEX addresses eg. excluding them from reward. 

Pancake Pair Should Be Excluded From Rewards

The condition `!_isExcluded[sender] && !_isExcluded[recipient]` can be included in `else` .

Redundant code

Some events are never emitted, which can lead to confusion and code maintainability issues.

```solidity=979
    event MinTokensBeforeSwapUpdated(uint256 minTokensBeforeSwap);
```
- `MinTokensBeforeSwapUpdated` is declared in `AntiBotLiquidityGeneratorToken` but never emitted.



Unused Event

Functions that update state variables should emit relevant events as notifications.

For example:
setEnableAntiBot(), deliver(), excludeFromReward(), includeInReward(), excludeFromFee(), setTaxFeePercent(), setLiquidityFeePercent(), setCharityFeePercent(), etc.

Missing Emit Events

Pepa

AntiBotLiquidityGeneratorToken.sol

The newest and most exciting memecoin! With a community-driven approach and a burning passion for memes, we believe Pepa Inu is the next big thing in the meme market.

Leaderboards

Due Diligence Tools

Resources

KYC Status

Bug Bounty Program