Meta Channel Network

CertiK1 address on BNB Chain

CertiK reviewed Meta Channel Network on 30 Aug 2022: 18 findings, 0 critical; 1 marked fixed, 17 open.

No open critical findings
Open the reportOpen Meta Channel Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings18

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High101
Medium300
Low1300
HighInitial Token DistributionOpen

Tokens are sent to deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

MediumIncorrect Burn FeeOpen

In functions `_takeburnFee()` and `_takeburnFeeZZ()`, if the `_tFeeTotal` is larger than 39,000,000 ether, it sets variables `_burnFee` and `_burnFeeZZ` to zero but still burns the fee. ```solidity=1831 if(_tFeeTotal >= 39000000 * 10**18)_burnFee = 0; _tOwned[address(0)] = _tOwned[address(0)].add(tAmount); _tFeeTotal = _tFeeTotal.add(tAmount); ``` However, the burned fee is not subtracted from `tAmount` at the end of the transfer process. ```solidity=1997 uint256 recipientRate = 10000 - _burnFee - _burnFeeZZ - _marketFee - _ReturnFee - _inviterFee; ```

MediumOnly Whitelisted Users Can Buy TokensOpen

Buying tokens from DEX will transfer tokens from the pair to the buyer. If `WhiteList` is enabled and the token sender is a pair, then only whitelisted users can receive tokens from DEX. ```solidity=1743 if (from == uniswapV2Pair||from == BNBPair) { if(WhiteList){ require(_isWhiteList[to] , "OnlyIsWhiteList"); } } ``` The following statements are redundant, as the `recipient` will not be the `address(uniswapV2Router)`. ```solidity=1891 if (sender == uniswapV2Pair||sender == BNBPair) {//buy cur = recipient; if (cur == address(uniswapV2Router)) { _tOwned[address(0)] = _tOwned[address(0)].add(tAmount.div(10000).mul(_inviterFee)); emit Transfer(sender, address(0), tAmount.div(10000).mul(_inviterFee)); return; } } else { ```

MediumRestriction on Selling TokensOpen

Users can only sell 999/1000 of their token balance in a transaction. If they want to sell 1000 ether tokens, they need to sell 999 ether on the first sale, sell 999/1000 ether on the second sale, and so on, thus bring the worse user experience. ```solidity=1753 if (to == uniswapV2Pair||to == BNBPair) { require(amount <= balanceOf(from) * 999 / 1000); } ```

LowDivide Before MultiplyOpen

Performing integer division before multiplication truncates the low bits, losing the precision of calculation.

LowFunction Should Be Declared ExternalOpen

The functions which are never called internally within the contract should have external visibility for gas optimization.

LowInvalid `takeFee` StatusOpen

The value of `takeFee` cannot be 2, it is redundant to check if it is equal to 2. ```solidity=1813 if (takeFee == 1 || takeFee == 2|| takeFee == 3) restoreAllFee(); ```

LowLack of Reasonable Fee LimitationOpen

The burn fee `_previousburnZZFee` lacks a reasonable cap and can be set to a very high rate.

LowLocked EtherOpen

The contract has one or more payable functions, but does not have a function to withdraw the fund. ```solidity=1598 receive() external payable {} ```

LowMissing Zero Address ValidationOpen

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1576 BNBPair = account; ``` - `account` is not zero-checked before being used.

Show 7 more
LowPull-Over-Push Pattern In `transferOwnership()` FOpen

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

LowRedundant CheckOpen

Selling tokens to a DEX will transfer tokens from the user to the pair. It is redundant to check if `from` is the `address(uniswapV2Router)`. ```solidity=1728 if (_isExcludedFromFee[from] || _isExcludedFromFee[to] || from == address(uniswapV2Router)) { takeFee = 1; } else ```

LowRedundant StatementsOpen

The fee rate for inviter is a constant 100, it is redundant to define the variable `accurRate`.

LowState Variable Should Be Declared ConstantOpen

State variables that never change should be declared as `constant` to save gas. --- ```solidity=1186 address public marketAddress = 0x871EE7f6e723C77afFb353b47C32c87C0c2757fA; ``` - `marketAddress` should be declared `constant`. --- ```solidity=1194 string private _name = "Meta Channel Network"; ``` - `_name` should be declared `constant`. --- ```solidity=1196 string private _symbol = "MCN"; ``` - `_symbol` should be declared `constant`. --- ```solidity=1198 uint8 private _decimals = 18; ``` - `_decimals` should be declared `constant`. --- ```solidity=1238 uint256 private _tTotal = 100000000 * 10**18; ``` - `_tTotal` should be declared `constant`.

LowThird Party DependencyOpen

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=1242 IUniswapV2Router02 public immutable uniswapV2Router; ``` - The contract `MCN` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.

LowUnnecessary Use of SafeMathOpen

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

LowUnused State VariableOpen

One or more state variables are never used in the codebase. Variables `_previousOwner` and `_lockTime` in `Ownable` are never used in `Ownable`. Variables `_updated` and `currentIndex` in `MCN` are never used in `MCN`.

Contracts in scope1

AddressChainSource code
0x1ecd7007beb60992fb16ee1d43a0d05edb139718Chain: BNB ChainSource code: Verified source

Part of Meta Channel Network’s security record

Meta Channel Network
Audits1 audit by 1 firmLast audit Aug 2022, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Meta Channel Network’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us