As of 3 Nov 2026, Sell Token has 1 audit report on Trustblock, by CertiK, dated 30 Mar 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 3 | 0 | 11 |
Flash loans are a way to borrow large amounts of money for a certain fee. The requirement is that the loans need to be returned within the same transaction in a block. If not, the transaction will be reverted. An attacker can use the borrowed money as the initial funds for an exploit to enlarge the profit and/or manipulate the token price in the decentralized exchanges. The below functions rely on price calculations that are based on-chain, meaning they are susceptible to flash-loan attacks by manipulating the price of given pairs to the attacker's benefit. - Minerals.getTokenPrice() - SellToken.getTokenPrice() - SellToken.getToken2Price() - SellToken.getToken3Price()
Open the reportOne or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums The below-listed functions/variables/parameters use extremely poor naming conventions: - The function `getpair()` performs the change of pair, which should be named as setPair. - The function `setToken()` sends tokens to the owner, which should be named as getToken. - The function `getToke()` returns the counterpart token names in the pair, which should be named as getTokenName. - The parameter _tolens, represents the address of the token/coin.
Open the reportAddresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=256 ceo=_ceo; ``` - `_ceo` is not zero-checked before being used. --- ```solidity=257 admin=_admin; ``` - `_admin` is not zero-checked before being used. --- ```solidity=447 _TRDT=_trdt; ``` - `_trdt` is not zero-checked before being used.
Open the reportThe linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="selltoken"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us