REBorn

CertiK1 address on BNB Chain

CertiK reviewed Hey Reborn [NEW] (REBorn) on 19 Apr 2023: 22 findings, 0 critical; 1 acknowledged, 21 open.

No open critical findings
Open the reportOpen Hey Reborn [NEW]’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High200
Medium010
Low1900
HighCentralization Risks in HeyReborn.solOpen

In the contract `HeyReborn` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and perform actions such as pause the contract and change the fee settings. ![](https://accelerator-tasks-prod.acc.corp.certik.com/dd5d86f68c2545f2806f33b0cc1cc238/diagrams/centralization_HeyReborn-HeyReborn-_owner.svg) In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer or renounce the ownership of the contract. ![](https://accelerator-tasks-prod.acc.corp.certik.com/dd5d86f68c2545f2806f33b0cc1cc238/diagrams/centralization_HeyReborn-Ownable-_owner.svg)

HighInitial Token DistributionOpen

All `Hey Reborn` tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute `Hey Reborn` tokens without the consensus of the community.

LowDivide Before MultiplyOpen

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=763 minLiquidityAmount = (_totalSupply * 2 / 10000) * 10 ** _decimals; ```

LowFunction Visibility OptimizationOpen

The following functions are declared as `public`, and are not invoked in any of the contracts contained within the project's scope. Functions that are never called internally within the contract should have `external` visibility.

LowInconsistent NatSpec for `transfer()` and `transfOpen

The NatSpec of the functions `transfer()` and `transferFrom()` state that the `nonReentrant` modifier is used. However, this modifier is not used in the specified functions.

LowMissing Zero Address ValidationOpen

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=756 marketingFundAddress = payable(_marketingFundAddress); ``` - `_marketingFundAddress` is not zero-checked before being used. --- ```solidity=757 routerAddress = _routerAddress; ``` - `_routerAddress` is not zero-checked before being used.

LowPontential Ineffective FunctionOpen

The `createPair()` function reverts if the `$VARIABLE - WETH` pair already exists. So calling the `getPair()` function before calling the `createPair()` function is better choice.

LowPotential Sandwich AttacksOpen

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by front running (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `swapExactTokensForETHSupportingFeeOnTransferTokens()` - `addLiquidityETH()` - `removeLiquidityETH()`

LowPrevious owner rights are not revoked After ownerOpen

When the contract is deployed, the owner is excluded from the transfer fees. However, when the ownership is transferred, the fees are not restored for the old owner and excluded for the new one.

LowPull-Over-Push Pattern In `transferOwnership()` FOpen

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

Show 10 more
LowState Variable Should Be Declared ConstantOpen

State variables that never change should be declared as `constant` to save gas. ```solidity=691 uint256 private _rTotal; ``` - `_rTotal` should be declared `constant`. --- ```solidity=716 address payable private partnershipFundAddress; ``` - `partnershipFundAddress` should be declared `constant`. --- ```solidity=717 address payable private airdropFundAddress; ``` - `airdropFundAddress` should be declared `constant`. --- ```solidity=719 address payable private staffFundAddress; ``` - `staffFundAddress` should be declared `constant`. --- ```solidity=720 address payable private burnFundAddress; ``` - `burnFundAddress` should be declared `constant`. --- ```solidity=721 address payable private holdersFundAddress; ``` - `holdersFundAddress` should be declared `constant`. --- ```solidity=726 address public pancakeFactory = 0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73; ``` - `pancakeFactory` should be declared `constant`. --- ```solidity=727 address public pancakeRouterAddress = 0x10ED43C718714eb63d5aA57B78B54704E256024E; ``` - `pancakeRouterAddress` should be declared `constant`. --- ```solidity=728 address public WETH = address(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c); //WBNB ``` - `WETH` should be declared `constant`.

LowThird Party DependencyOpen

The contract is serving as the underlying entity to interact with third party `PancakeSwap` protocol. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

LowToo Many DigitsOpen

Literals with many digits are difficult to read and review.

LowUnlocked Compiler VersionOpen

The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUnnecessary Use of SafeMathOpen

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=119 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=686 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `HeyReborn` contract. ```solidity=767 balances[msg.sender] = balances[msg.sender].add(_totalSupply); ``` - `SafeMath.add` is called in `constructor` function of `HeyReborn` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 26) are shown above.*

LowUnused `private` FunctionOpen

The functions `removeAllFee()` and `restoreAllFee()` are private functions never called within the contract. At no point in execution will `removeAllFee()` or `restoreAllFee()` be called.

LowUnused Return ValueOpen

The return value of an external call is not stored in a local or state variable. ```solidity=1113 pancakeswapV2Router.addLiquidityETH{value: _bnbTokenAmount}( address(this), _rbTokenAmount, 0, // slippage is unavoidable 0, // slippage is unavoidable owner(), block.timestamp ); ``` --- ```solidity=1129 pancakeswapV2Router.removeLiquidityETH( address(this), _liquidityAmountToRemove, 0, 0, owner(), block.timestamp ); ```

LowUnused State VariableOpen

One or more state variables are never used in the codebase. Variable `_rTotal` in `HeyReborn` is never used in `HeyReborn`. ```solidity=691 uint256 private _rTotal; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `_rOwned` in `HeyReborn` is never used in `HeyReborn`. ```solidity=697 mapping (address => uint256) private _rOwned; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `partnershipFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=716 address payable private partnershipFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `airdropFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=717 address payable private airdropFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `staffFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=719 address payable private staffFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `burnFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=720 address payable private burnFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `holdersFundAddress` in `HeyReborn` is never used in `HeyReborn`. ```solidity=721 address payable private holdersFundAddress; ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ``` --- Variable `MAX` in `HeyReborn` is never used in `HeyReborn`. ```solidity=735 uint256 private constant MAX = ~uint256(0); ``` ```solidity=685 contract HeyReborn is Ownable, IBEP2E,ReentrancyGuard { ```

LowUsage of `transfer`/`send` for sending EtherOpen

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=1161 payable(msg.sender).transfer(_amount); ``` - `HeyReborn.withdraw` uses `transfer()`.

LowUser-Defined GettersOpen

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

Show 1 more
LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope1

AddressChainSource code
0x441bb79f2da0daf457bad3d401edb68535fb3faaChain: BNB ChainSource code: Verified source

Part of Hey Reborn [NEW]’s security record

Hey Reborn [NEW]
Audits1 audit by 1 firmLast audit Apr 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Hey Reborn [NEW]’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us