Baby Troll - Audit

All of the BabyTroll tokens are sent to the contract deployer. This is a centralization risk because the deployer can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer address may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

In the BabyTroll contract, taxes are distributed in two ways: a) using `swapAndLiquify` functionality to add liquidity to token pair. b) swap BabyTroll tokens to BNB and send to different wallets. The auditor noticed that only 1% of the tokens are used for providing liquidity, 99% of the tokens are sent to different wallets, which is disproportionate.

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by backrunning (executing after the target) a transaction to sell the asset.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=949 distributeTaxes(contractTokenBalance); ``` * This function call executes the following external call(s). * In `BabyTroll.sendBNB`, * `(success,None) = address(_to).call{value: amount}("")` * In `BabyTroll._swapTokensForBNB`, * `router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` * In `BabyTroll.swapAndLiquify`, * `router.addLiquidityETH{value: newBalance}(address(this),otherHalf,0,0,deadWallet,block.timestamp)` ### State variables written after the call(s) ```solidity=950 _isSwapping = false; ``` ```solidity=965 super._transfer(sender, address(this), taxAmount); ``` * This function call executes the following assignment(s). * In `ERC20._update`, * `_balances[from] = fromBalance - value` * In `ERC20._update`, * `_balances[to] += value` ```solidity=966 super._transfer(sender, recipient, transferAmount); ``` * This function call executes the following assignment(s). * In `ERC20._update`, * `_balances[from] = fromBalance - value` * In `ERC20._update`, * `_balances[to] += value` *Note: Only a sample of 3 assignments (out of 4) are shown above.* --- ### External call(s) ```solidity=977 swapAndLiquify(liquidityTaxIntokens); ``` * This function call executes the following external call(s). * In `BabyTroll._swapTokensForBNB`, * `router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` * In `BabyTroll.swapAndLiquify`, * `router.addLiquidityETH{value: newBalance}(address(this),otherHalf,0,0,deadWallet,block.timestamp)` ```solidity=982 _swapTokensForBNB(remaningTokens); ``` ```solidity=989 sendBNB(developing, wallet1BNB); ``` * This function call executes the following external call(s). * In `BabyTroll.sendBNB`, * `(success,None) = address(_to).call{value: amount}("")` ```solidity=992 sendBNB(marketing, wallet2BNB); ``` ### State variables written after the call(s) ```solidity=992 sendBNB(marketing, wallet2BNB); ``` * This function call executes the following assignment(s). * In `ReentrancyGuard._nonReentrantAfter`, * `_status = _NOT_ENTERED` * In `ReentrancyGuard._nonReentrantBefore`, * `_status = _ENTERED` --- ### External call(s) ```solidity=977 swapAndLiquify(liquidityTaxIntokens); ``` * This function call executes the following external call(s). * In `BabyTroll._swapTokensForBNB`, * `router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` * In `BabyTroll.swapAndLiquify`, * `router.addLiquidityETH{value: newBalance}(address(this),otherHalf,0,0,deadWallet,block.timestamp)` ```solidity=982 _swapTokensForBNB(remaningTokens); ``` ```solidity=989 sendBNB(developing, wallet1BNB); ``` * This function call executes the following external call(s). * In `BabyTroll.sendBNB`, * `(success,None) = address(_to).call{value: amount}("")` ```solidity=992 sendBNB(marketing, wallet2BNB); ``` ```solidity=995 sendBNB(marketing2, wallet3BNB); ``` ### State variables written after the call(s) ```solidity=995 sendBNB(marketing2, wallet3BNB); ``` * This function call executes the following assignment(s). * In `ReentrancyGuard._nonReentrantAfter`, * `_status = _NOT_ENTERED` * In `ReentrancyGuard._nonReentrantBefore`, * `_status = _ENTERED` Note that the `developing`, `marketing` and `marketing2` address is set by the Owner, so the possibility of this exploit depends on on-chain configuration.

The allowance is approved to the router based on the token swapping amount in the swapAndLiquify function. Therefore, approving the maximum allowance to the router is redundant and unnecessary.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=848 IRouter public router; ``` - The contract `BabyTroll` interacts with third party contract with `IRouter` interface via `router`. --- ```solidity=866 AntiBot private AB; ``` - The contract `BabyTroll` interacts with third party contract with `AntiBot` interface via `AB`. Note that `AB` is highly relevant to the privilege of calling function `internalEnableTrading`, which can enable/disable user transfer.

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring native tokens, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=917 marketingAddress.transfer(address(this).balance); ``` - `BabyTroll.rescueBNB` uses `transfer()`.