Pepa

CertiK23 May 20231 address on BNB Chain

Audit

CertiK reviewed Pepa Inu (Pepa) on 23 May 2023: 16 findings, 0 critical; 2 marked fixed, 1 acknowledged, 13 open.

No open critical findings

Open the report Open Pepa Inu’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	1
Medium	0	1	1
Low	12	0	0

HighInitial Token DistributionOpen

All initial `PEPA` tokens are sent to the address `_owner` by the following statement when deploying the contract. This is a potential centralization risk as the deployer can distribute `Golteum` tokens without the consensus of the community. ```solidity=1042 _rOwned[owner()] = _rTotal; ```

LowIncorrect error messageOpen

The error message in the function `includeInReward()` does not describe the error correctly. ```solidity=1225 require(_isExcluded[account], "Account is already excluded") ```

LowMissing Emit EventsOpen

Functions that update state variables should emit relevant events as notifications. For example: setEnableAntiBot(), deliver(), excludeFromReward(), includeInReward(), excludeFromFee(), setTaxFeePercent(), setLiquidityFeePercent(), setCharityFeePercent(), etc.

LowMissing Zero Address ValidationOpen

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=1065 payable(serviceFeeReceiver_).transfer(serviceFee_); ``` - `serviceFeeReceiver_` is not zero-checked before being used.

LowPancake Pair Should Be Excluded From RewardsOpen

Generally, deflationary tokens are incompatible with DEX and special rules need to be coded for DEX addresses eg. excluding them from reward.

LowPrivilege not Revoked or TransferredOpen

When the contract is deployed the following addresses are exempted from fees: - the address `_owner` If ownership is transferred or renounced with `transferOwnership()` or `renounceOwnership()`, the exemptions are not granted to the new owner nor are they revoked from the previous owner.

LowRedundant codeOpen

The condition `!_isExcluded[sender] && !_isExcluded[recipient]` can be included in `else` .

LowSending Ether to Arbitrary DestinationsOpen

The function `constructor()` is payable and sends an arbitrary amount of Ether to an arbitrary address(`serviceFeeReceiver_`). The destination `serviceFeeReceiver_` and Ether amount `serviceFee_` are both passed in as inputs. We want to confirm with the client the purpose of this implementation. ```solidity=1065 payable(serviceFeeReceiver_).transfer(serviceFee_); ```

LowThe purpose of function `deliver`Open

The function `deliver()` can be called by anyone. It accepts an uint256 number parameter `tAmount`. The function reduces the METT token balance of the caller by `rAmount`, which is `tAmount` reduces the transaction fee. Then, the function adds `tAmount` to variable `_tFeeTotal`, which represents the contract's total transaction fee. We wish the team could explain more on the purpose of having such functionality.

LowUnnecessary Use of SafeMathOpen

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=201 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=934 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `AntiBotLiquidityGeneratorToken` contract. ```solidity=1038 numTokensSellToAddToLiquidity = totalSupply_.div(10**3); // 0.1% ``` - `SafeMath.div` is called in `constructor` function of `AntiBotLiquidityGeneratorToken` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 54) are shown above.*

Show 3 more

LowUnused EventOpen

Some events are never emitted, which can lead to confusion and code maintainability issues. ```solidity=979 event MinTokensBeforeSwapUpdated(uint256 minTokensBeforeSwap); ``` - `MinTokensBeforeSwapUpdated` is declared in `AntiBotLiquidityGeneratorToken` but never emitted.

LowUsage of `transfer`/`send` for sending EtherOpen

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=1065 payable(serviceFeeReceiver_).transfer(serviceFee_); ``` - `AntiBotLiquidityGeneratorToken.constructor` uses `transfer()`.

LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.