Hello.one - Audit 2

CertiK11 Oct 2022Files named in the report

Audit

CertiK reviewed HELLO Labs (Hello.one - Audit 2) on 11 Oct 2022: 22 findings, 0 critical; 20 marked fixed, 2 open.

No open critical findings

Open the report Open HELLO Labs’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	2	1
Medium	0	1
Low	0	18

HighThe function `airdrop()` can be used by `owner` tFixed

The function `airdrop()` is used to distribute tokens and can be called multiple times by the `owner`. In addition, `owner` can airdrop `H1T3` from any address to any other address without approval as it calls `_basicTransfer()` which does not require any approvals. Any compromise to the `owner` account may allow the hacker to take any holders `H1T3`.

MediumIncorrect Math FormulaFixed

`_developmentFee` is used instead of `_burnFee`.

Low`initialize()` Is UnprotectedFixed

The function `initialize()` is `external` and can be called by anyone as long as the contract is deployed.

LowComment is incorrect if `setMaxWalletPercent()` iFixed

This comment is only correct if the `setMaxWalletPercent()` has not been used to change the percentage.

LowEmit Event Cannot Be ReachedFixed

There is a `return` before the `emit` so that the event will never be emitted.

LowFunction Should Be Declared ExternalFixed

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity function tradingStatus(bool _status) public onlyOwner { function getCirculatingSupply() public view returns (uint256) { function rescueToken(address tokenAddress, uint256 tokens) function clearStuckBalance(uint256 amountPercentage, address adr) public onlyOwner { function setWhitelisted(address _wallet, bool status) public onlyOwner { ```

LowFunction State Mutability cab be restricted to `pFixed

The function `totalSupply()` does not read or modify state and is declared as `view`.

LowImproper Way to Send Native TokensFixed

The function `clearStuckBalance()` uses Solidity's built in `transfer()` function. There are potential issues with this as this forwards exactly 2300 gas and if the receiving contract has a `fallback` function or gas prices are changed, then the transaction may be reverted. See this [doc](https://ethereum.stackexchange.com/questions/19341/address-send-vs-address-transfer-best-practice-usage) for more details.

LowInternal Function Names Should Start with `_`Fixed

The functions `takeFee`, `shouldTakeFee`, and `checkTxLimit` are all declared as `internal`. The naming convention for `internal` functions is that they start with `_`.

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Show 10 more

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

LowNo reasonable upper limit for `totalfee`Fixed

Any user with the `authorized` role can set `_liquidityFee`, `_marketingFee`, `_developmentFee`, `_burnFee`, and `_feeDenominator`, but the upper limit is just that the total sum of fees is less than `feeDenominator`. In the extreme case this means the total fee can be as high as 99.9999...%.

LowPossible Public VariablesFixed

Although `totalFee` is a public variable, the fees that go into it are not made public. Users may want to know exactly how much of the `totalFee` is used for liquidity, marketing, development, and burning as well as what the denominator for `totalFee` is.

LowPotential Risk On `approve()`/`transferFrom()` MeFixed

The `approve` function could be used in a Front-Running attack that allows a spender to transfer more tokens than the owner of the tokens ever wanted to allow the spender to transfer. Here is a possible attack scenario: Alice allows Bob to transfer N of Alice's tokens (N>0) by calling approve method on Token smart contract passing Bob's address and N as method arguments After some time, Alice decides to change from N to M (M>0) the number of Alice's tokens Bob is allowed to transfer, so she calls approve method again, this time passing Bob's address and M as method arguments Bob notices Alice's second transaction before it was mined and quickly sends another transaction that calls ·transferFrom· method to transfer N Alice's tokens somewhere If Bob's transaction will be executed before Alice's transaction, then Bob will successfully transfer N Alice's tokens and will gain the ability to transfer another M tokens Before Alice noticed that something went wrong, Bob calls ·transferFrom· method again, this time to transfer M Alice's tokens. So, Alice's attempt to change Bob's allowance from N to M (N>0 and M>0) made it possible for Bob to transfer N+M of Alice's tokens, while Alice never wanted to allow so many of her tokens to be transferred by Bob. ERC20 API: An Attack Vector on [Approve/TransferFrom Methods](https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit#heading=h.m9fhqynw2xvt)

LowRedundant SafeMath UsageFixed

Solidity version >=0.8.0 includes checked arithmetic operations and underflow/overflow by default, making SafeMath redundant.

LowState variable never usedFixed

The state variable `launchedAt` was never used.

LowToo Many DigitsFixed

Literals with many digits are difficult to read and review. File: contracts/Main.sol (Line 467, Function `Main.slitherConstructorConstantVariables`) ```solidity address constant DEAD = 0x000000000000000000000000000000000000dEaD; ``` --- File: contracts/Main.sol (Line 468, Function `Main.slitherConstructorConstantVariables`) ```solidity address constant ZERO = 0x0000000000000000000000000000000000000000; ```

LowTypo in commentFixed

The word `settting` in this comment should be spelled `setting`.

LowUnlocked Compiler VersionFixed

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

LowUser balance cannot reach `_maxWalletToken`Fixed

The `amount` in the formula noted above is untaxed and is not the amount a user will receive if their transaction was taxed.