CertiK reviewed W3binfinity (WBY) on 9 Sep 2022: 15 findings, 0 critical; 3 acknowledged, 12 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 12 | 0 | 0 |
There following code is *unused* inside the contract, and this could impact the readability of the contract. Additionally, the unused functions might introduce vulnerabilities in the future upgrade of the contract if the code is forgotten. - `_mint(address,uint256)`
The functions which are never called internally within the contract should have external visibility for gas optimization. The following functions are declared as `public`: - `renounceOwnership()` - `transferOwnership()` - `name()` - `symbol()` - `decimals()` - `transfer()` - `approve()` - `transferFrom()` - `increaseAllowance()` - `decreaseAllowance()` - `burn()` - `burnFrom()`
The function that affects the status of sensitive variables should be able to emit events as notifications. - `function setFee(uint256 _fee)`
There is no `receive()` or `fallback()` function in the `WBYToken.sol`,then this contract cannot receive any native token(BNB). However, the contract has the following functions that are designed to withdraw native tokens to the owner: - `wiBNB()` - `WiAmountBNB()` In this case, without a valid fallback function, these functions will not be capable to send any native token(BNB) because the **balance** of the native tokens will be **empty** forever.
Addresses should be checked before assignment or external call to make sure they are not zero addresses. The following functions are concerned : - `setMarketingAddress()`
State variables that never change should be declared as `constant` to save gas. ```solidity=1245 uint256 maxSupply = 1000000000*10 ** 18; ``` - `maxSupply` should be declared `constant`.
The return value of the transfer()/transferFrom() call is not checked. ```solidity=1315 IERC20(token).transfer(msg.sender, IERC20(token).balanceOf(address(this))); ``` --- ```solidity=1327 IERC20(token).transfer(msg.sender, amount); ```
Contracts should be deployed using the same compiler version/flags with which they have been tested. Locking the pragma (e.g. by not using ^ in pragma solidity 0.8.4) ensures that contracts do not accidentally get deployed using a compiler version with unfixed bugs. Reference: [SWC-103] https://swcregistry.io/docs/SWC-103
```solidity=335 library Address { ``` - The library `Address` is declared but never used.
The variables `lpAddresses` & `router` are declared but the current code logic **don't use** these variables. Moreover removing *unused variables* will **improve** gas consumption. ```solidity=1244 mapping(address => bool) lpAddresses; ``` ```solidity=1237 IPancakeSwapRouter public router; ```
`block.timestamp` is used for comparison, which can be risky since timestamp can be influenced by miners. That means the miner creating the block can manipulate the `block.timestamp`, to some degree, and change the outcome of the transaction. ```solidity=1300 require(block.timestamp <= blacklistTime, "blacklistTime: invalid"); ```
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage. ```solidity=1239 uint public blacklistTime; ```
| Address | Chain | Source code |
|---|---|---|
| 0x4ecf…2dbe0x4ecfb318e6a0ecb81a6f82a269e40487b14a2dbe | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us