Babylong - Audit

The change of `owner` by function `transferOwnership()` overrides the previously set `owner` with the new one without guaranteeing the new `owner` has the ability to actuate transactions on-chain.

In the function `bind`, the `_inviter[receiver]` will be set to the `sender` when sender is not a contract and balance of the `receiver` is 0. But when the `receiver` that is not `_uniswapV2Pair`, receives another token transfer from another address within 3 blocks, the `_inviter[receiver]` will be set to 0. The inviter fee will be sent to `_inviter[user]` when buying or selling BABYLONG tokens from/to the pair in function `takeInviterFee`. When the user buys tokens from the pair within the three blocks from the transaction that he first receive those tokens, the sender of the first transaction will not receive any inviter fee.

State variables that never change should be declared as `constant` to save gas. ```solidity=295 string public website = "https://x.com/Babylong_2024"; ``` - `website` should be declared `constant`. --- ```solidity=296 string public Telegram = "https://t.me/babylong2024"; ``` - `Telegram` should be declared `constant`. --- ```solidity=297 string public X = "https://x.com/Babylong_2024"; ``` - `X` should be declared `constant`. --- ```solidity=298 string public QQ = "https://x.com/Babylong_2024"; ``` - `QQ` should be declared `constant`.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=317 address public _router ; ``` The contract transfers swapped WBNB from the `_router` to the contact address. The `_router` is set to 0xAE7519Aeba4f8aE44d3852633231456b4080eBca, which is an unverified contract. ```solidity=327 IUniswapV2Router02 public _uniswapV2Router; ``` - The contract `GGGTOKEN` interacts with third party contract with `IUniswapV2Router02` interface via `_uniswapV2Router`.

The return values of the `transfer()` and `transferFrom()` calls in the smart contract are not checked. Some ERC-20 tokens' transfer functions return no values, while others return a bool value, they should be handled with care. If a function returns `false` instead of reverting upon failure, an unchecked failed transfer could be mistakenly considered successful in the contract. ```solidity=626 try IERC20(_token).transfer(_marketAddr, IERC20(_token).balanceOf(address(this))) {} catch {} ``` --- ```solidity=755 IERC20(_token).transferFrom( _router,address(this), IERC20(_token).balanceOf(address(_router))); ```

The low-level `call` function returns the status of the call as first variable in the returned tuple. The status of the `call` is not asserted to be `true`, which would treat the low-level call as a success even when it reverted. ```solidity=388 _token.call(abi.encodeWithSelector(0x095ea7b3, _uniswapV2Router, ~uint256(0))); ``` --- ```solidity=903 token.call(abi.encodeWithSelector(0x095ea7b3, to, ~uint256(0))); ```

The for loop contains repeated storage read access in the condition check. Given that the ending condition does not change in the for loop, the repeated storage read is unnecessary, and its associated high gas cost can be eliminated. ```solidity=391 for(uint i ;i<_inviters.length;i++){ ``` Loop condition `i < _inviters.length` accesses the `length` field of a storage array. --- ```solidity=645 for (uint256 i = 0; i < _inviters.length; i++) { ``` Loop condition `i < _inviters.length` accesses the `length` field of a storage array. --- ```solidity=712 for(uint i ;i<_inviters.length;i++){ ``` Loop condition `i < _inviters.length` accesses the `length` field of a storage array.

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=129 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=293 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `GGGTOKEN` contract. ```solidity=353 _swapTokensAtAmount = _tTotal.mul(1).div(10**4); ``` - `SafeMath.mul` is called in `initialize` function of `GGGTOKEN` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 61) are shown above.*

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=292 contract GGGTOKEN is IERC20, Ownable { ``` - `GGGTOKEN` is an upgradeable contract that does not protect its initializer. ```solidity=341 function initialize ( bytes memory _data) public { ``` - `initialize` is an unprotected initializer function.

The line 586 checks if the from address is a bot and reverts if it is. However, the if-check on line 587 still check if the from address is a bot, the statement on line 588 will never get executed. The `_inviterFee` is the sum of `_inviters` in function `initialize` and `setInviterFee`. The `accurRate` is also the sum of `_inviters` in function `takeInviterFee`, thus the `_inviterFee.sub(accurRate)` will be 0 and the statement on line 655 will never get executed.