Web3AiTools security record

The contract owner can adjust the tax to as high as 100% on transactions. The owner account should be taken care to not be mismanaged else the privileges associated with the account can slip into the hands of the hacker. Also, if renouncing ownership is not done appropriately, the current contract owner can renounce ownership, and lose access to owner privileges. Functions like setting tax, and wallet addresses will be uncallable and any updates needed to be made will be inaccessible.

Upon deployment, some functions can be limited in functionality if the state variables they interact with are not properly set.

For founders and team advisors, the arithmetic calculations carried out determine how tokens will be released to users per quarter. Although the checks are implemented the transfers do not happen. When claim() is called, an update to the balances mapping occurs which causes an overproduction of the tokens; the number of tokens held by all addresses after distribution and claim, exceeds the total supply value noted by the totalSupply function. This is problematic as it leaves the tokens in the custody of the contract and not the intended recipients.

Although underflows and overflows are checked internally in solidity versions >0.8.0, multiple logical arithmetic checks would be needed in the codebase dependent on the client. setReleaseTime(), setSupply_Team_Allocation(), setBuyandSellTax(), setTokenPrice() are likely pivots to exploit this vulnerability.

Due to the logic utilized in the claim function, the Founder and Team Advisors addresses should not be the same. If the Founders and Team Advisors are the same address it would lead to 5% of the token total supply being locked in the contract until the address is updated again. With the check below, if founders == teamAdvisors only the first code block will get executed.

The codebase lacks unit test coverage. It is advisable to have test coverage greater than 95% of the codebase to reduce unexpected functionality and help fuzz test as many invariants as possible.

Changes to state in deployed contracts can be easily tracked using events, especially when logs would need to be kept. The contract allows multiple key variables to be reset and it would be advisable to emit events when this occurs.

The docs say tax is 0 but it's possible to set tax to any arbitrary value, even 100 which would make users lose all their tokens when they perform a transfer/swap if the PancakeSwap interface gets implemented as expected. The codebase contains a few spelling errors, and does not conform to the recommended Solidity standard of code formatting.

The solidity pragma version in this codebase is unlocked

The internal “_mint()” function is only called by the distribute() function which has the onlyOwner modifier attached to it as well. Calling it again internally will lead to extra costs spent on gas which can be avoided.