RISC(RisingCoin)
CertiK reviewed RisingCoin (RISC(RisingCoin)) on 21 Nov 2022: 24 findings, 0 critical; 1 marked fixed, 2 acknowledged, 21 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings24
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 21 | 0 | 0 |
LowFunction Initializing StateOpen
State variables are inline initialized using either non-constant state variables or function calls that are not pure/constant. Since inline initialization occurs before the constructor call, some non-constant state variables may not be initialized and non-constant functions may behave in an unexpected way. ```solidity=426 uint256 private _totalSupply = 100000000 * 10**_decimals; uint256 public _maxTxAmount =100000000* 10**_decimals; uint256 public _walletMax = 100000000 * 10**_decimals; uint256 private minimumTokensBeforeSwap = 100 * 10**_decimals; ```
LowFunctions Can Be Declared `external`Open
`public` functions that are never called by the contract could be declared as `external`.
LowLack of Input ValidationOpen
The values functions which are used to change the values of `_totalTaxIfBuying`,`_totalTaxIfSelling` and `_totalDistributionShares` lack input validation to ensure these values do not exceed 100.
LowMissing Emit EventsOpen
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
LowMissing Error MessagesOpen
The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.
LowMissing Zero Address ValidationOpen
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=600 marketingWalletAddress = payable(newAddress); ``` - `newAddress` is not zero-checked before being used. --- ```solidity=604 teamWalletAddress = payable(newAddress); ``` - `newAddress` is not zero-checked before being used.
LowPotential Sandwich AttacksOpen
A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset. The `swapExactTokensForETHSupportingFeeOnTransferTokens()` and `addLiquidityETH()` functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks.
LowPrivilege not Revoked or TransferredOpen
The owner is exempt from fees and transaction limits by default. Yet, when ownership is reset through `renounceOwnership()` or `transferOwnership()`, the exemptions are not granted to the new owner, nor are they revoked from the previous owner. Similarly, upon changing the router address using `changeRouterVersion()`, the old router address will still be exempt from fees and the wallet limit, and will still have an allowance.
LowPull-Over-Push Pattern In `transferOwnership()` FOpen
The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.
LowRedundant CheckOpen
The linked **if** statement checks if `inSwapAndLiquify` is false, however, this check is redundant because the only way to reach this **if** block is if it fails the first one, therefore `inSwapAndLiquify` must be false here.
Show 10 more
LowState Variable Should Be Declared `constant`Open
State variables that never change should be declared as `constant` to save gas.
LowThird Party DependencyOpen
The contract is serving as the underlying entity to interact with one or more third-party protocols. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=431 IUniswapV2Router02 public uniswapV2Router; ``` - The contract `RisingCoin` interacts with third-party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.
LowToo Many DigitsOpen
Literals with many digits are difficult to read and review. ```solidity=426 uint256 private _totalSupply = 100000000 * 10**_decimals; uint256 public _maxTxAmount =100000000* 10**_decimals; uint256 public _walletMax = 100000000 * 10**_decimals; ```
LowTypoOpen
The linked function is misspelled and should be changed to `setSellTaxes()`.
LowUnnecessary Use of SafeMathOpen
The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.
LowUnused ContractOpen
```solidity=392 using Address for address; ``` - The library `Address` is declared on a using-for directive in `RisingCoin` but its functionalities are never used.
LowUnused EventOpen
```solidity=440 event SwapAndLiquify( uint256 tokensSwapped, uint256 ethReceived, uint256 tokensIntoLiqudity ); ``` - `SwapAndLiquify` is declared in `RisingCoin` but never emitted. --- ```solidity=446 event SwapETHForTokens( uint256 amountIn, address[] path ); ``` - `SwapETHForTokens` is declared in `RisingCoin` but never emitted.
LowUnused InterfaceOpen
```solidity=205 interface IUniswapV2Pair { ``` - `IUniswapV2Pair` is declared but never used.
LowUnused Return ValueOpen
The return value of an external call is not stored in a local or state variable. ```solidity=753 uniswapV2Router.addLiquidityETH{value: ethAmount}( address(this), tokenAmount, 0, // slippage is unavoidable 0, // slippage is unavoidable owner(), block.timestamp ); ```
LowUnused State VariableOpen
One or more state variables are never used in the codebase. Variable `asdasd` in `Ownable` is never used in `RisingCoin`. ```solidity=152 address private asdasd; ``` ```solidity=389 contract RisingCoin is Context, IERC20, Ownable { ``` --- Variable `_lockTime` in `Ownable` is never used in `RisingCoin`. ```solidity=153 uint256 private _lockTime; ``` ```solidity=389 contract RisingCoin is Context, IERC20, Ownable { ```
Show 1 more
LowUsage of `transfer`/`send` for sending EtherOpen
It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=621 recipient.transfer(amount); ``` - `RisingCoin.transferToAddressETH` uses `transfer()`.
Contracts in scope1
| Address | Chain | Source code |
|---|---|---|
| 0x932d73dccdb2a6b4f06fd8436f29e42cae33d26a | Chain: BNB Chain | Source code: Verified source |
Part of RisingCoin’s security record
Security firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us