CertiK reviewed Hey Reborn [NEW] (REBorn) on 19 Apr 2023: 22 findings, 0 critical; 1 acknowledged, 21 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 19 | 0 | 0 |
In the contract `HeyReborn` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and perform actions such as pause the contract and change the fee settings.  In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer or renounce the ownership of the contract. 
All `Hey Reborn` tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute `Hey Reborn` tokens without the consensus of the community.
Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=763 minLiquidityAmount = (_totalSupply * 2 / 10000) * 10 ** _decimals; ```
The following functions are declared as `public`, and are not invoked in any of the contracts contained within the project's scope. Functions that are never called internally within the contract should have `external` visibility.
The NatSpec of the functions `transfer()` and `transferFrom()` state that the `nonReentrant` modifier is used. However, this modifier is not used in the specified functions.
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=756 marketingFundAddress = payable(_marketingFundAddress); ``` - `_marketingFundAddress` is not zero-checked before being used. --- ```solidity=757 routerAddress = _routerAddress; ``` - `_routerAddress` is not zero-checked before being used.
The `createPair()` function reverts if the `$VARIABLE - WETH` pair already exists. So calling the `getPair()` function before calling the `createPair()` function is better choice.
A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by front running (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `swapExactTokensForETHSupportingFeeOnTransferTokens()` - `addLiquidityETH()` - `removeLiquidityETH()`
When the contract is deployed, the owner is excluded from the transfer fees. However, when the ownership is transferred, the fees are not restored for the old owner and excluded for the new one.
The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.
State variables that never change should be declared as `constant` to save gas. ```solidity=691 uint256 private _rTotal; ``` - `_rTotal` should be declared `constant`. --- ```solidity=716 address payable private partnershipFundAddress; ``` - `partnershipFundAddress` should be declared `constant`. --- ```solidity=717 address payable private airdropFundAddress; ``` - `airdropFundAddress` should be declared `constant`. --- ```solidity=719 address payable private staffFundAddress; ``` - `staffFundAddress` should be declared `constant`. --- ```solidity=720 address payable private burnFundAddress; ``` - `burnFundAddress` should be declared `constant`. --- ```solidity=721 address payable private holdersFundAddress; ``` - `holdersFundAddress` should be declared `constant`. --- ```solidity=726 address public pancakeFactory = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73; ``` - `pancakeFactory` should be declared `constant`. --- ```solidity=727 address public pancakeRouterAddress = 0x10ED43C718714eb63d5aA57B78B54704E256024E; ``` - `pancakeRouterAddress` should be declared `constant`. --- ```solidity=728 address public WETH = address(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c); //WBNB ``` - `WETH` should be declared `constant`.
The contract is serving as the underlying entity to interact with third party `PancakeSwap` protocol. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.
Literals with many digits are difficult to read and review.
The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.
The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=119 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=686 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `HeyReborn` contract. ```solidity=767 balances[msg.sender] = balances[msg.sender].add(_totalSupply); ``` - `SafeMath.add` is called in `constructor` function of `HeyReborn` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 26) are shown above.*
The functions `removeAllFee()` and `restoreAllFee()` are private functions never called within the contract. At no point in execution will `removeAllFee()` or `restoreAllFee()` be called.
The return value of an external call is not stored in a local or state variable. ```solidity=1113 pancakeswapV2Router.addLiquidityETH{value: _bnbTokenAmount}( address(this), _rbTokenAmount, 0, // slippage is unavoidable 0, // slippage is unavoidable owner(), block.timestamp ); ``` --- ```solidity=1129 pancakeswapV2Router.removeLiquidityETH( address(this), _liquidityAmountToRemove, 0, 0, owner(), block.timestamp ); ```
One or more state variables are never used in the codebase. Variable `_rTotal` in `HeyReborn` is never used in `HeyReborn`. ```solidity=691 uint256 private _rTotal; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `_rOwned` in `HeyReborn` is never used in `HeyReborn`. ```solidity=697 mapping (address => uint256) private _rOwned; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `partnershipFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=716 address payable private partnershipFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `airdropFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=717 address payable private airdropFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `staffFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=719 address payable private staffFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `burnFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=720 address payable private burnFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `holdersFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=721 address payable private holdersFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `MAX` in `HeyReborn` is never used in `HeyReborn`. ```solidity=735 uint256 private constant MAX = ~uint256(0); ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ```
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=1161 payable(msg.sender).transfer(_amount); ``` - `HeyReborn.withdraw` uses `transfer()`.
The linked functions are equivalent to the compiler-generated getter functions for the respective variables.
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
| Address | Chain | Source code |
|---|---|---|
| 0x441b…3faa0x441bb79f2da0daf457bad3d401edb68535fb3faa | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us