LionCEO - Audit

CertiK30 Mar 2023Files named in the report

Audit

CertiK reviewed LionCEO (LionCEO - Audit) on 30 Mar 2023: 17 findings, 0 critical; 1 acknowledged, 16 open.

No open critical findings

Open the report Open LionCEO’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged
Critical	0	0
High	2	0
Medium	0	1
Low	14	0

HighCentralization Risks in lion.solOpen

In the contract `LIONCEO` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change sensitive state addresses and dividend data. ![](https://accelerator-tasks-prod.acc.corp.certik.com/20371b489b6a494a934879863c1e800c/diagrams/centralization_lion-LIONCEO-_owner.svg) In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer or renounce ownership. ![](https://accelerator-tasks-prod.acc.corp.certik.com/20371b489b6a494a934879863c1e800c/diagrams/centralization_lion-Ownable-_owner.svg)

HighInitial Token DistributionOpen

All LCEO tokens are sent to the contract owner when deploying the contract. This is a potential centralization risk as the owner can distribute LCEO tokens without the consensus of the community.

LowDividends Not UpdatedOpen

For a user to receive dividends, their token balance should exceed the `minimumTokenBalanceForDividends` variable. This variable can be changed via the `updateMinimumTokenBalanceForDividends()` function. However, when `minimumTokenBalanceForDividends` is changed, the users that can receive dividends is unchanged. This means that if `minimumTokenBalanceForDividends` is increased, users whose balance is below the new `minimumTokenBalanceForDividends` but above the old `minimumTokenBalanceForDividends` can still receive dividends.

LowGas Fee for Storage Updates Passed to UserOpen

In the function `_transfer()`, the function `process()` is called to update state information. The execution of `process()` helps maintain intended tokenomics but passes the cost of gas to the address executing `_transfer()`.

LowMissing Emit EventsOpen

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowPotential Sandwich AttacksOpen

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by backrunning (executing after the target) a transaction to sell the asset. The linked functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens()` - `uniswapV2Router.swapExactETHForTokensSupportingFeeOnTransferTokens()`

LowState Variable Should Be Declared ConstantOpen

State variables that never change should be declared as `constant` to save gas. ```solidity=907 uint256 public gasForProcessing = 300_000; ``` - `gasForProcessing` should be declared `constant`.

LowThird Party DependencyOpen

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=894 IUniswapV2Router02 public uniswapV2Router; ``` - The contract `LIONCEO` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaOpen

The return value of the transfer()/transferFrom() call is not checked. ```solidity=985 ERC20token.transfer(msg.sender, balance); ```

LowUnnecessary Use of SafeMathOpen

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

Show 6 more

LowUnsafe Integer CastOpen

```solidity=164 return int(map.indexOf[key]); ``` - The type conversion `int256(map.indexOf[key])` from type uint256 to type int256 may flip the value's sign. --- ```solidity=748 iterationsUntilProcessed = index.sub(int256(lastProcessedIndex)); ``` - The type conversion `int256(lastProcessedIndex)` from type uint256 to type int256 may flip the value's sign. --- ```solidity=756 iterationsUntilProcessed = index.add(int256(processesUntilEndOfArray)); ``` - The type conversion `int256(processesUntilEndOfArray)` from type uint256 to type int256 may flip the value's sign.

LowUnused Return ValueOpen

The return value of an external call is not stored in a local or state variable. ```solidity=1214 dividendTracker.processAccount(payable(msg.sender), false); ``` --- ```solidity=1218 dividendTracker.processAccount(payable(claimee), false); ```

LowUnused State VariableOpen

One or more state variables are never used in the codebase. Variable `MAX_INT256` in `SafeMathInt` is never used in `SafeMathInt`. ```solidity=103 int256 private constant MAX_INT256 = ~(int256(1) << 255); ``` ```solidity=101 library SafeMathInt { ``` The variables `liquidityFeeOnBuy` and `liquidityFeeOnSell` are assigned but never meaningfully referenced in `LIONCEO`. ```solidity=932 liquidityFeeOnBuy = 0; ``` ```solidity=938 liquidityFeeOnSell = 0; ```

LowUpdating InconsistenciesOpen

The initial values for addresses `owner()` and `marketingWallet` are exempt from fees in the constructor. However, if the state addresses were to be modified from the respective functions `transferOwnership()` or `changeMarketingWallet`, the fee exemption would still be applied to the initial addresses, not the updated addresses.

LowUsage of `transfer`/`send` for sending EtherOpen

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=980 payable(msg.sender).transfer(address(this).balance); ``` - `LIONCEO.claimStuckTokens` uses `transfer()`.

LowVariables That Could Be Declared as ImmutableOpen

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.