CertiK reviewed Lil Floki on 10 Jul 2023: 13 findings, 0 critical; 2 acknowledged, 11 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 10 | 0 | 0 |
There are no upper boundaries for `BNBRewardsFee`, `liquidityFee`, and `marketingFee` which are set in `setFee()`. It is possible to set the total fee rates up to any arbitrary amount, which will potentially lead to an unexpected result or miscalculation of the fees.
A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=94 (bool success,) = user.call{value: _withdrawableDividend, gas: 3000}(""); ``` ### State variables written after the call(s) ```solidity=97 withdrawnDividends[user] = withdrawnDividends[user].sub(_withdrawableDividend); ``` --- ### External call(s) ```solidity=360 swapAndLiquify(swapTokens); ``` * This function call executes the following external call(s). * In `LilFloki.addLiquidity`, * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)` * In `LilFloki.swapTokensForEth`, * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` ```solidity=363 sendBNBToMarketing(marketingTokens); ``` ```solidity=366 swapAndSendDividends(sellTokens); ``` * This function call executes the following external call(s). * In `LilFloki.swapAndSendDividends`, * `(success) = address(dividendTracker).call{value: dividends}("")` * In `LilFloki.sendBNBToMarketing`, * `_marketingWallet.transfer(bnbToSend)` ### State variables written after the call(s) ```solidity=368 swapping = false; ``` ```solidity=389 super._transfer(from, address(this), fees); ``` * This function call executes the following assignment(s). * In `ERC20._transfer`, * `_balances[sender] = _balances[sender].sub(amount,"ERC20: transfer amount exceeds balance")` * In `ERC20._transfer`, * `_balances[recipient] = _balances[recipient].add(amount)` ```solidity=392 super._transfer(from, to, amount); ``` * This function call executes the following assignment(s). * In `ERC20._transfer`, * `_balances[sender] = _balances[sender].sub(amount,"ERC20: transfer amount exceeds balance")` * In `ERC20._transfer`, * `_balances[recipient] = _balances[recipient].add(amount)` --- ### External call(s) ```solidity=663 if(processAccount(payable(account), true)) { ``` * This function call executes the following external call(s). * In `DividendPayingToken._withdrawDividendOfUser`, * `(success) = user.call{gas: 3000,value: _withdrawableDividend}("")` ### State variables written after the call(s) ```solidity=679 lastProcessedIndex = _lastProcessedIndex; ```
| Address | Chain | Source code |
|---|---|---|
| 0x3271…db350x3271d12d5ba36b6582fafa029598fee0f5f6db35 | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us