selltoken

CertiKFiles named in the report

CertiK reviewed Sell Token (selltoken) on 30 Mar 2023: 16 findings, 0 critical; 12 marked fixed, 4 open.

No open critical findings
Open the reportOpen Sell Token’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium001
Low3011
HighPotential Flashloan AttackOpen

Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit and/or manipulate the token price in the decentralized exchanges. The below functions rely on price calculations that are based on-chain, meaning they are susceptible to flash-loan attacks by manipulating the price of given pairs to the attacker's benefit. - Minerals.getTokenPrice() - SellToken.getTokenPrice() - SellToken.getToken2Price() - SellToken.getToken3Price()

LowIncorrect naming conventionOpen

One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums The below-listed functions/variables/parameters use extremely poor naming conventions: - The function `getpair()` performs the change of pair, which should be named as setPair. - The function `setToken()` sends tokens to the owner, which should be named as getToken. - The function `getToke()` returns the counterpart token names in the pair, which should be named as getTokenName. - The parameter _tolens, represents the address of the token/coin.

LowMissing Zero Address ValidationOpen

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=256 ceo=_ceo; ``` - `_ceo` is not zero-checked before being used. --- ```solidity=257 admin=_admin; ``` - `_admin` is not zero-checked before being used. --- ```solidity=447 _TRDT=_trdt; ``` - `_trdt` is not zero-checked before being used.

LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • sellTokenNew8.18-1.sol

Part of Sell Token’s security record

Sell Token
Audits1 audit by 1 firmLast audit Mar 2023, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Sell Token’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us