Lil Floki security record

In the contract `LilFlokiDividendTracker` the role `_owner` has authority over the functions shown in the diagram below.  - `excludeFromDividends(address account)`: This function excludes a specific account from dividends. It requires that the account is not already excluded. This function can only be called by the owner. - `updateClaimWait(uint256 newClaimWait)`: This function updates the claim wait time. It requires that the new claim wait time is between 1 minute and 24 hours and is not the same as the current claim wait time. This function can only be called by the owner. - `setBalance(address payable account, uint256 newBalance)`: This function sets the balance of a particular account. If the account is excluded from dividends, the function returns. If the new balance is greater than or equal to the minimum token balance for dividends, it updates the balance and includes the account in the token holders map. If the new balance is less, it removes the account from the token holders map. It then processes the account. This function can only be called by the owner. - `processAccount(address payable account, bool automatic)`: This function processes a particular account for withdrawal of dividends. If the withdrawal amount is greater than 0, it updates the last claim time and emits a Claim event. It returns true if the withdrawal amount is greater than 0, otherwise it returns false. This function can only be called by the owner. --- In the contract `LilFloki` the role `_owner` has authority over the functions shown in the diagram below.  - `updateDividendTracker(address newAddress)`: Updates the dividend tracker to a new address. This function can only be called by the owner of the contract. - `updateUniswapV2Router(address newAddress)`: Updates the Uniswap V2 router to a new address. This function can only be called by the owner of the contract. - `setMarketingWallet(address payable wallet)`: Sets the marketing wallet to a new address. This function can only be called by the owner of the contract. - `setFee(uint256 _BNBRewardsFee, uint256 _liquidityFee, uint256 _marketingFee)`: Sets the fees for BNB rewards, liquidity, and marketing. This function can only be called by the owner of the contract. - `setMaxWalletToken(uint256 _maxToken)`: Sets the maximum amount of tokens that a wallet can hold. This function can only be called by the owner of the contract. - `setMaxSellTransaction(uint256 _maxTxn)`: Sets the maximum amount of tokens that can be sold in a transaction. This function can only be called by the owner of the contract. - `addToBlackList(address[] calldata addresses)`: Adds addresses to a blacklist. This function can only be called by the owner of the contract. - `removeFromBlackList(address account)`: Removes an address from the blacklist. This function can only be called by the owner of the contract. - `excludeFromFees(address account, bool excluded)`: Excludes an account from fees. This function can only be called by the owner of the contract. - `excludeMultipleAccountsFromFees(address[] calldata accounts, bool excluded)`: Excludes multiple accounts from fees. This function can only be called by the owner of the contract. - `setAutomatedMarketMakerPair(address pair, bool value)`: Sets a pair for the automated market maker. This function can only be called by the owner of the contract. - `updateLiquidityWallet(address newLiquidityWallet)`: Updates the liquidity wallet to a new address. This function can only be called by the owner of the contract. - `updateGasForProcessing(uint256 newValue)`: Updates the amount of gas for processing. This function can only be called by the owner of the contract. - `updateClaimWait(uint256 claimWait)`: Updates the claim wait time. This function can only be called by the owner of the contract. - `EnableTrading()`: Enables trading. This function can only be called by the owner of the contract. --- In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  - `renounceOwnership()`: This function allows the current owner of the contract to renounce their ownership. After this function is executed, there will be no owner and `onlyOwner` functions will not be callable anymore. This function can only be called by the current owner of the contract. - `transferOwnership(address newOwner)`: This function allows the current owner of the contract to transfer the ownership to another address. The function requires that the `newOwner` address must not be the zero address. This function ca

The spelling of 'exlcude' is a typo

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=161 _marketingWallet = wallet; ``` - `wallet` is not zero-checked before being used.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. *This finding is considered minor because the state variable is only incremented or decremented. So, the effect of out-of-order increments may be unobservable after transaction. However, the reentrancy vulnerability may still cause other issues in the middle of transaction.* ### External call(s) ```solidity=360 swapAndLiquify(swapTokens); ``` * This function call executes the following external call(s). * In `LilFloki.addLiquidity`, * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)` * In `LilFloki.swapTokensForEth`, * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` ```solidity=363 sendBNBToMarketing(marketingTokens); ``` ### State variables written after the call(s) ```solidity=363 sendBNBToMarketing(marketingTokens); ``` * This function call executes the following assignment(s). * In `ERC20._approve`, * `_allowances[owner][spender] = amount` --- ### External call(s) ```solidity=360 swapAndLiquify(swapTokens); ``` * This function call executes the following external call(s). * In `LilFloki.addLiquidity`, * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)` * In `LilFloki.swapTokensForEth`, * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` ```solidity=363 sendBNBToMarketing(marketingTokens); ``` ```solidity=366 swapAndSendDividends(sellTokens); ``` * This function call executes the following external call(s). * In `LilFloki.swapAndSendDividends`, * `(success) = address(dividendTracker).call{value: dividends}("")` ### State variables written after the call(s) ```solidity=366 swapAndSendDividends(sellTokens); ``` * This function call executes the following assignment(s). * In `ERC20._approve`, * `_allowances[owner][spender] = amount` --- ### External call(s) ```solidity=421 swapTokensForEth(half); // <- this breaks the ETH -> HATE swap when swap+liquify is triggered ``` * This function call executes the following external call(s). * In `LilFloki.swapTokensForEth`, * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)` ```solidity=427 addLiquidity(otherHalf, newBalance); ``` * This function call executes the following external call(s). * In `LilFloki.addLiquidity`, * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,liquidityWallet,block.timestamp)` ### State variables written after the call(s) ```solidity=427 addLiquidity(otherHalf, newBalance); ``` * This function call executes the following assignment(s). * In `ERC20._approve`, * `_allowances[owner][spender] = amount` --- ### External call(s) ```solidity=685 uint256 amount = _withdrawDividendOfUser(account); ``` * This function call executes the following external call(s). * In `DividendPayingToken._withdrawDividendOfUser`, * `(success) = user.call{gas: 3000,value: _withdrawableDividend}("")` ### State variables written after the call(s) ```solidity=688 lastClaimTimes[account] = block.timestamp; ```

The return values of functions swapExactTokensForETHSupportingFeeOnTransferTokens and addLiquidityETH are not properly handled.

State variables that never change should be declared as `constant` to save gas. ```solidity=30 uint256 public swapTokensAtAmount = 200000000 * (10**18); ``` - `swapTokensAtAmount` should be declared `constant`.

Given the require(false) statement, the code block from line 148 to line 150 will never be executed and is unnecessary. ``` solidity=145 function _transfer(address from, address to, uint256 value) internal virtual override { require(false); int256 _magCorrection = magnifiedDividendPerShare.mul(value).toInt256Safe(); magnifiedDividendCorrections[from] = magnifiedDividendCorrections[from].add(_magCorrection); magnifiedDividendCorrections[to] = magnifiedDividendCorrections[to].sub(_magCorrection); } ```

```solidity=566 iterationsUntilProcessed = index.sub(int256(lastProcessedIndex)); ``` - The type conversion `int256(lastProcessedIndex)` from type uint256 to type int256 may flip the value's sign. --- ```solidity=574 iterationsUntilProcessed = index.add(int256(processesUntilEndOfArray)); ``` - The type conversion `int256(processesUntilEndOfArray)` from type uint256 to type int256 may flip the value's sign.

The return value of an external call is not stored in a local or state variable. ```solidity=293 dividendTracker.processAccount(msg.sender, false); ``` --- ```solidity=459 uniswapV2Router.addLiquidityETH{value: ethAmount}( address(this), tokenAmount, 0, // slippage is unavoidable 0, // slippage is unavoidable liquidityWallet, block.timestamp ); ```

One or more state variables are never used in the codebase. Variable `MAX_INT256` in `SafeMathInt` is never used in `SafeMathInt`. ```solidity=36 int256 private constant MAX_INT256 = ~(int256(1) << 255); ``` ```solidity=34 library SafeMathInt { ```