Taboo

CertiK23 Nov 2022Files named in the report

Audit

CertiK reviewed Taboo 2.0 (Taboo) on 23 Nov 2022: 5 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open Taboo 2.0’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	0
Medium	0	0	0
Low	4	0	0

HighPrivileged OwnershipOpen

The owner of contract `CAR` has the permission to: 1. change the charity address that charityFee is sent to, 2. exclude/include addresses from rewards/fees, 3. set the value of sensitive variables, such as `taxFee`, `burnFee`, `reflectionFee`, `charityFee`, `liquidityFee` and `_maxTxTokens`, without obtaining the consensus of the community.

LowMissing Emit EventsOpen

The function that affects the status of sensitive variables should be able to emit events as notifications. - `setAsCharityAccount()` - `updateFee()`

LowMutability Specifiers MissingOpen

The linked variables are assigned only once, either during their contract-level declaration or during the `constructor`'s execution: - _MAX - _GRANULARITY

LowRedundant CodeOpen

The condition `!_isExcluded[sender] && !_isExcluded[recipient]` can be included in `else` .

LowVariable `_rOwned` not updatedOpen

Variable `_rOwned` is not updated in function `includeAccount()`, which will make the accounts included siphon off the tokens out of the balances of all accounts that are currently holders. Details of this finding can be seen in this article from Pera Finance: [Link]https://perafinance.medium.com/safemoon-is-it-safe-though-a-detailed-explanation-of-frictionless-yield-bug-338710649846