Read the findings of the 2022 Web3 Security Report

The contract is serving as the underlying entity to interact with third party `PancakeSwap` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

According to the logic in `constructor()`, the contract deployed in the address which used to initialize interface `uniswapV2Router` is `PancakeSwap: Router v2`, naming doesn't match the real contract.

```solidity=1060
constructor() ERC20("AnimeHatchery", "AHY") {
  IUniswapV2Router02 _uniswapV2Router = IUniswapV2Router02(0x10ED43C718714eb63d5aA57B78B54704E256024E);
  // Create a uniswap pair for this new token  /// hailong : pancake
  address _uniswapV2Pair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this), _uniswapV2Router.WETH());

  uniswapV2Router = _uniswapV2Router;
```

Function And Variable Naming Doesn't Match The Operating Environment

In the contract `AnimeHatchery` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/c7b47e59757a4d50b7e6789c3ed4e92a/diagrams/centralization-AnimeHatchery-_owner.svg)

Centralization Risk in AnimeHatchery.sol

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as constant

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

Performing integer division before multiplication truncates the low bits, losing the precision of calculation.

File: projects/AnimeHatchery/AnimeHatchery.sol (Line 1121, Function `AnimeHatchery._transfer`)
```solidity
  super._transfer(from, _nftAddress, amount.div(50).mul(3));
```


---
File: projects/AnimeHatchery/AnimeHatchery.sol (Line 1122, Function `AnimeHatchery._transfer`)
```solidity
  amount = amount.div(50).mul(41);
```



Divide Before Multiply

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

File: projects/AnimeHatchery/AnimeHatchery.sol (Line 1082, Function `AnimeHatchery.updateNftAddress`)
```solidity
    _nftAddress = newAddress;
```
- `newAddress` is not zero-checked before being used.

---

File: projects/AnimeHatchery/AnimeHatchery.sol (Line 1085, Function `AnimeHatchery.updateMarketingAddress`)
```solidity
    _marketingAddress = newAddress;
```
- `newAddress` is not zero-checked before being used.

Missing Zero Address Validation

One or more state variables are never used in the codebase.

Private state variable `_destroyAddress` in `AnimeHatchery` is never used in `AnimeHatchery`.

File: projects/AnimeHatchery/AnimeHatchery.sol (Line 1051, Contract `AnimeHatchery`)
```solidity=1051
	address private _destroyAddress = address(0x000000000000000000000000000000000000dEaD);
```

---
Private state variable `_inviterFeeSwitch` in `AnimeHatchery` is only used in function `updateInviterFeeSwitch()`. Only the role `_owner` is able to set the value for this state variable but the value is never used.

```solidity=1054
    bool private _inviterFeeSwitch = true;
```
```solidity=1087
    function updateInviterFeeSwitch(bool inviterFeeSwitch) public onlyOwner {
        _inviterFeeSwitch = inviterFeeSwitch;
    }
```

Unused State Variable

In function `_transfer()`, if it is necessary to pay transaction fee, the calculation logic of transaction fee and amount of funds is following :

```solidity=1119
if (takeFee) {
  super._transfer(from, _marketingAddress, amount.div(50));
  super._transfer(from, _nftAddress, amount.div(50).mul(3));
  amount = amount.div(50).mul(41);
}
super._transfer(from, to, amount);
```

The rate of fee paid to `_marketingAddress` is $ 1 / 50 = 2% $, the rate of fee paid to `_nftAddress` is $ 3 / 50 = 6% $, and the ratio of funds sent to recipient is $ 41 / 50 = 82% $.

The sum of these three ratios is $ 90% $, it should be $ 100% $.

Incorrect Calculation of `Amount`

10 million `AHY` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `AHY` tokens without obtaining the consensus of the community.

Initial Token Distribution

AnimeHatchery

Animehatchery

Code Audit History

11

0

11

0

0