<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectButton />

<username>{{ maskedUsername }}</username><space /><text>just voted for</text><space /><projectLogo /><space /><projectName>{{ projectName }}</projectName>

Bug Bounty rewards are grouped by severity and the impact of the vulnerability. Examples and descriptions of the type of vulnerabilities that correspond to each severity level can be found below. The payout amount has a 5 tier structure with separate scalesfor website/apps and smart contracts.

Description of vulnerability and your proof of concept or validation steps

Name

Please input a title

Short description of the vulnerability and the affected asset.

The core team is situated in country(ies) that received low aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests an increased difficulty and complexity in preventing and mitigating fraud.

The core team is situated in country(ies) that received medium aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests a medium level of geographic accountability, thus reducing and mitigating the risk of fraud.

The core team is situated in country(ies) that received the best aggregated ratings in terms of international judicial cooperation, criminal justice system, anti-money laundering, and corruption. This contextual data suggests the highest level of geographic accountability, thus maximizing the risk reduction and mitigation.

Vulnerability Title

Shibas Wife

The owner of contract `ShibasWife` has authority below listed variables/behaviors/functions:

- `renounceOwnership()`
- `transferOwnership()`
- `excludeFromReward()`
- `includeInReward()`
- `excludeFromFee()`
- `includeInFee()`
- `setTaxFeePercent()`
- `setCauseFeePercent()`
- `setGrowthFeePercent()`
- `setLiquidityFeePercent()`
- `setMaxTxPercent()`
- `setSwapAndLiquifyEnabled()`

Any compromise to the `owner]` account may allow the hacker to take advantage of this and update the sensitive settings and executive sensitive functions of the project.

Centralization Related Risks

Variables that never changed after assignment, can be declared as `constant`
- `_tTotal` 
- `_decimals`
- `numTokensSellToAddToLiquidity`



Variable Could Be Declared as `constant`

The contract is serving as the underlying entity to interact with external dependencies Uniswap protocols. The scope of the audit would treat those external dependencies entities as black boxes and assume functional correctness. In fact, any external dependencies might be compromised that led to assets being lost or stolen.

External Dependencies Risk

The event input variable contains a typo in its body, namely `tokensIntoLiqudity` should be `tokensIntoLiquidity`.

Comment Typo

The function `deliver` can be called by anyone. It accepts an uint256 number parameter `tAmount`. The function reduces the Shibaswife token balance of the caller by `rAmount`, which is `tAmount` reduces the transaction fee. Then, the function adds `tAmount` to variable `_tFeeTotal`, which represents the contract's total transaction fee. 

Ambitious Function `deliver`

Public functions that are never called by the contract could be declared external. When the inputs are arrays external functions are more efficient than `public` functions. Public functions that are never called by the contract could be declared external. When the inputs are arrays external functions are more efficient than `public` functions.

Example functions :
- `deliver(uint)`
- `excludeFromReward(address)`
- `excludeFromFee(address)`
- `includeInFee(address)`
- `setSwapAndLiquifyEnabled(bool)`

Function Visibility Optimization

The linked comment contains a typo in its statement, namely `recieve` && `swaping` should be `receive` && `swapping`.

The `swapAndLiquify` function converts half of the `contractTokenBalance` Shibaswife tokens to ETH. The other half of Shibaswife tokens and part of the converted ETH are deposited into the Shibaswife-ETH pool on uniswap as liquidity. For every `swapAndLiquify` function call, a small amount of ETH leftover in the contract. This is because the price of Shibaswife drops after swapping the first half of Shibaswife tokens into ETHs, and the other half of Shibaswife tokens require less than the converted ETH to be paired with it when adding liquidity. The contract doesn't appear to provide a way to withdraw those ETH, and they will be locked in the contract forever.

Contract Gains Non-Withdrawable ETH Via The `swapAndLiquify` Function

The return values of function `addLiquidityETH` is not properly handled.

```solidity=1224
uniswapV2Router.addLiquidityETH{value: ethAmount}(
    address(this),
    tokenAmount,
    0, // slippage is unavoidable
    0, // slippage is unavoidable
    owner(),
    block.timestamp
);
```

Return Value Unhandled

```solidity=1223
// add the liquidity
uniswapV2Router.addLiquidityETH{value: ethAmount}(
    address(this),
    tokenAmount,
    0, // slippage is unavoidable
    0, // slippage is unavoidable
    owner(),
    block.timestamp
);
```

The `addLiquidity` function calls the `uniswapV2Router.addLiquidityETH` function with the `to` address specified as `owner()` for acquiring the generated LP tokens from the `Shibaswife-ETH` pool. As a result, over time the `_owner` address will accumulate a significant portion of LP tokens. If the `_owner` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences to the project as a whole.


Centralized Risk in `addLiquidity`

The condition `!_isExcluded[sender] && !_isExcluded[recipient]` can be included in `else` .

Leaderboards

Due Diligence Tools

Resources

KYC Status