LiveGreen Coin security record

The function `MAPSet()` and `MAPRemove()` can be called by anyone as they have no access restriction. Anyone can call the `MAPSet()` function to become a token holder or call the `MAPRemove()` function to remove other holders from the map. ```solidity function MAPSet(address key, uint val) public { if (tokenHoldersMap.inserted[key]) { tokenHoldersMap.values[key] = val; } else { tokenHoldersMap.inserted[key] = true; tokenHoldersMap.values[key] = val; tokenHoldersMap.indexOf[key] = tokenHoldersMap.keys.length; tokenHoldersMap.keys.push(key); } } function MAPRemove(address key) public { if (!tokenHoldersMap.inserted[key]) { return; } delete tokenHoldersMap.inserted[key]; delete tokenHoldersMap.values[key]; uint index = tokenHoldersMap.indexOf[key]; uint lastIndex = tokenHoldersMap.keys.length - 1; address lastKey = tokenHoldersMap.keys[lastIndex]; tokenHoldersMap.indexOf[lastKey] = index; delete tokenHoldersMap.indexOf[key]; tokenHoldersMap.keys[index] = lastKey; tokenHoldersMap.keys.pop(); } ```

The constructor of the contract `CoinToken` excludes the contract's owner, the dead wallet, the UniswapV2 pair, and the UniswapV2 router from dividends. ```solidity _setAutomatedMarketMakerPair(_uniswapV2Pair, true); ... function _setAutomatedMarketMakerPair(address pair, bool value) private { require(automatedMarketMakerPairs[pair] != value, "Automated market maker pair is already set to that value"); automatedMarketMakerPairs[pair] = value; if(value) { dividendTracker.excludeFromDividends(pair); } emit SetAutomatedMarketMakerPair(pair, value); } ``` ```solidity=1330 dividendTracker.excludeFromDividends(owner()); dividendTracker.excludeFromDividends(deadWallet); dividendTracker.excludeFromDividends(address(_uniswapV2Router)); ``` However, when changing any of the above key addresses, the new address is not removed from dividends. Changing the owner: ```solidity=37 function transferOwnership(address newOwner) public virtual onlyOwner { require(newOwner != address(0), "Ownable: new owner is the zero address"); _transferOwnership(newOwner); } function _transferOwnership(address newOwner) internal virtual { address oldOwner = _owner; _owner = newOwner; emit OwnershipTransferred(oldOwner, newOwner); } ``` Changing the dead wallet: ```solidity=1496 function setDeadWallet(address addr) public onlyOwner { deadWallet = addr; } ``` Changing the UniswapV2 router and pair: ```solidity=1355 function updateUniswapV2Router(address newAddress) public onlyOwner { require(newAddress != address(uniswapV2Router), "The router already has that address"); emit UpdateUniswapV2Router(newAddress, address(uniswapV2Router)); uniswapV2Router = IUniswapV2Router02(newAddress); address _uniswapV2Pair = IUniswapV2Factory(uniswapV2Router.factory()) .createPair(address(this), uniswapV2Router.WETH()); uniswapV2Pair = _uniswapV2Pair; } ```

The `swapAndLiquify` function converts part of the `contractTokenBalance` `CoinToken` to ETH. The other part of `CoinToken` and part of the converted ETH are deposited into the `CoinToken-ETH` pool on Uniswap as liquidity. For every `swapAndLiquify` function call, a small amount of ETH is left over in the contract. This is because the price of `CoinToken` drops after swapping the first part of `CoinToken` into ETH, and the other part of `CoinToken` require less than the converted ETH to be paired with it when adding liquidity. The contract doesn't appear to provide a way to withdraw those ETH, and they will be locked in the contract forever.

The `try / catch` keywords are used to handle failed external calls and are used in the `_transfer()` function when setting balances of the sender and recipient. ```solidity=1589 try dividendTracker.setBalance(payable(from), balanceOf(from)) {} catch {} try dividendTracker.setBalance(payable(to), balanceOf(to)) {} catch {} ``` If one of the above calls failed, such as due to an overflow error or casting error, the transaction will not revert. This may be an issue as tokens are still transferred between `from` and `to`.

The variable `swapTokensAtAmount` is used to determine the threshold for when to swap fees for rewards, liquidity, and dividends. The documentation states that this threshold is 0.002% of the total supply. ```solidity=1309 swapTokensAtAmount = totalSupply.mul(2).div(10**6); // 0.002% ``` However, the implementation actually uses 0.0002%.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=817 REWARD_TOKEN = _rewardTokenAddress; ``` - `_rewardTokenAddress` is not zero-checked before being used. --- ```solidity=1323 uniswapV2Pair = _uniswapV2Pair; ``` - `_uniswapV2Pair` is not zero-checked before being used. --- ```solidity=1357 uniswapV2Pair = _uniswapV2Pair; ``` - `_uniswapV2Pair` is not zero-checked before being used. --- ```solidity=1376 _marketingWalletAddress = wallet; ``` - `wallet` is not zero-checked before being used. --- ```solidity=1497 deadWallet = addr; ``` - `addr` is not zero-checked before being used.

The function `_transfer` will charge a transfer fee. The issue is that when both `from` and `to` accounts are included in `automatedMarketMakerPairs`, the `AmountLiquidityFee`, `AmountTokenRewardsFee`, and `AmountMarketingFee` will be accumulated twice: ```solidity if(automatedMarketMakerPairs[from]){ LFee = amount.mul(buyLiquidityFee).div(100); AmountLiquidityFee += LFee; RFee = amount.mul(buyTokenRewardsFee).div(100); AmountTokenRewardsFee += RFee; MFee = amount.mul(buyMarketingFee).div(100); AmountMarketingFee += MFee; DFee = amount.mul(buyDeadFee).div(100); fees = LFee.add(RFee).add(MFee).add(DFee); } if(automatedMarketMakerPairs[to]){ LFee = amount.mul(sellLiquidityFee).div(100); AmountLiquidityFee += LFee; RFee = amount.mul(sellTokenRewardsFee).div(100); AmountTokenRewardsFee += RFee; MFee = amount.mul(sellMarketingFee).div(100); AmountMarketingFee += MFee; DFee = amount.mul(sellDeadFee).div(100); fees = LFee.add(RFee).add(MFee).add(DFee); } ``` However, the user will only have the fees deducted once: ```solidity if(automatedMarketMakerPairs[from]){ .... fees = LFee.add(RFee).add(MFee).add(DFee); } if(automatedMarketMakerPairs[to]){ .... fees = LFee.add(RFee).add(MFee).add(DFee); } amount = amount.sub(fees); ... ``` This will result in an inconsistency between the actual fee charged and the calculated fee and when the fee is swapped it may fail because the actual fee maybe insufficient.

For a user to receive dividends, their token balance should exceed the `minimumTokenBalanceForDividends` variable. This variable can be changed via the `setMinimumTokenBalanceForDividends()` function. ```solidity=980 function setMinimumTokenBalanceForDividends(uint256 val) external onlyOwner { minimumTokenBalanceForDividends = val; } ``` However, when `minimumTokenBalanceForDividends` is changed, the users that can receive dividends is unchanged. This means that if `minimumTokenBalanceForDividends` is increased, users whose balance is below the new `minimumTokenBalanceForDividends` but above the old `minimumTokenBalanceForDividends` can still receive dividends.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=1608 IERC20(rewardToken).transfer(_marketingWalletAddress, newBalance); ```