CertiK reviewed Meta Channel Network on 30 Aug 2022: 18 findings, 0 critical; 1 marked fixed, 17 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 1 |
| Medium | 3 | 0 | 0 |
| Low | 13 | 0 | 0 |
Tokens are sent to deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.
In functions `_takeburnFee()` and `_takeburnFeeZZ()`, if the `_tFeeTotal` is larger than 39,000,000 ether, it sets variables `_burnFee` and `_burnFeeZZ` to zero but still burns the fee. ```solidity=1831 if(_tFeeTotal >= 39000000 * 10**18)_burnFee = 0; _tOwned[address(0)] = _tOwned[address(0)].add(tAmount); _tFeeTotal = _tFeeTotal.add(tAmount); ``` However, the burned fee is not subtracted from `tAmount` at the end of the transfer process. ```solidity=1997 uint256 recipientRate = 10000 - _burnFee - _burnFeeZZ - _marketFee - _ReturnFee - _inviterFee; ```
Buying tokens from DEX will transfer tokens from the pair to the buyer. If `WhiteList` is enabled and the token sender is a pair, then only whitelisted users can receive tokens from DEX. ```solidity=1743 if (from == uniswapV2Pair||from == BNBPair) { if(WhiteList){ require(_isWhiteList[to] , "OnlyIsWhiteList"); } } ``` The following statements are redundant, as the `recipient` will not be the `address(uniswapV2Router)`. ```solidity=1891 if (sender == uniswapV2Pair||sender == BNBPair) {//buy cur = recipient; if (cur == address(uniswapV2Router)) { _tOwned[address(0)] = _tOwned[address(0)].add(tAmount.div(10000).mul(_inviterFee)); emit Transfer(sender, address(0), tAmount.div(10000).mul(_inviterFee)); return; } } else { ```
Users can only sell 999/1000 of their token balance in a transaction. If they want to sell 1000 ether tokens, they need to sell 999 ether on the first sale, sell 999/1000 ether on the second sale, and so on, thus bring the worse user experience. ```solidity=1753 if (to == uniswapV2Pair||to == BNBPair) { require(amount <= balanceOf(from) * 999 / 1000); } ```
Performing integer division before multiplication truncates the low bits, losing the precision of calculation.
The functions which are never called internally within the contract should have external visibility for gas optimization.
The value of `takeFee` cannot be 2, it is redundant to check if it is equal to 2. ```solidity=1813 if (takeFee == 1 || takeFee == 2|| takeFee == 3) restoreAllFee(); ```
The burn fee `_previousburnZZFee` lacks a reasonable cap and can be set to a very high rate.
The contract has one or more payable functions, but does not have a function to withdraw the fund. ```solidity=1598 receive() external payable {} ```
Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1576 BNBPair = account; ``` - `account` is not zero-checked before being used.
The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.
Selling tokens to a DEX will transfer tokens from the user to the pair. It is redundant to check if `from` is the `address(uniswapV2Router)`. ```solidity=1728 if (_isExcludedFromFee[from] || _isExcludedFromFee[to] || from == address(uniswapV2Router)) { takeFee = 1; } else ```
The fee rate for inviter is a constant 100, it is redundant to define the variable `accurRate`.
State variables that never change should be declared as `constant` to save gas. --- ```solidity=1186 address public marketAddress = 0x871EE7f6e723C77afFb353b47C32c87C0c2757fA; ``` - `marketAddress` should be declared `constant`. --- ```solidity=1194 string private _name = "Meta Channel Network"; ``` - `_name` should be declared `constant`. --- ```solidity=1196 string private _symbol = "MCN"; ``` - `_symbol` should be declared `constant`. --- ```solidity=1198 uint8 private _decimals = 18; ``` - `_decimals` should be declared `constant`. --- ```solidity=1238 uint256 private _tTotal = 100000000 * 10**18; ``` - `_tTotal` should be declared `constant`.
The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=1242 IUniswapV2Router02 public immutable uniswapV2Router; ``` - The contract `MCN` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.
The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.
One or more state variables are never used in the codebase. Variables `_previousOwner` and `_lockTime` in `Ownable` are never used in `Ownable`. Variables `_updated` and `currentIndex` in `MCN` are never used in `MCN`.
| Address | Chain | Source code |
|---|---|---|
| 0x1ecd…97180x1ecd7007beb60992fb16ee1d43a0d05edb139718 | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us