In the contract `Aven` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and:
- change sell and buy tax values.
- rescue all the ETH or the ERC20 tokens from the contract.
- exempt malicious address from paying fees on transfers.
- update marketing and treasury wallets.
- update liquidity threshold and deadline.
- enable the trading.
- change the `providingLiquidity` state.
![](https://accelerator-tasks-prod.s3.amazonaws.com/339238d83d1a4207900e422fba4e9a3c/diagrams/centralization_Aven-Aven-_owner.svg)

---
In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer the ownership to a malicious address he owns or controls.
![](https://accelerator-tasks-prod.s3.amazonaws.com/339238d83d1a4207900e422fba4e9a3c/diagrams/centralization_Aven-Ownable-_owner.svg)

Centralization Risks in Aven.sol

All of the `AVEN` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `AVEN` tokens without obtaining the consensus of the community.

Initial Token Distribution

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc.

Particularly, the contract `Aven` interacts with a third party AMM with `IRouter` interface via `router`.

Third Party Dependency

The modifier `lockTheSwap()` does not always execute `_;` or revert due to the if-condition placed at the beginning of the modifier.

Incorrect modifier

Performing integer division before multiplication truncates the low bits, losing the precision of calculation.
In the contract the following division:

```solidity=573
            uint256 unitBalance = deltaBalance / (denominator - swapTaxes.liquidity);
```

is made before the following multiplication:
```solidity=574
            uint256 ethToAddLiquidityWith = unitBalance * swapTaxes.liquidity;
```



Divide Before Multiply

The return value of the following `transfer()` call is not checked.

```solidity=695
        IERC20(_tokenAdd).transfer(owner(), _amount);
```



Unchecked ERC-20 `transfer()` Call

The `transferFrom()` function at line 181 transfers tokens before updating the storage variables through `_approve()`. This does not follow the Checks-Effects-Interactions pattern.

`TransferFrom()` Alters State After Transfer

`marketingWallet` and `treasuryWallet` are exempted from fees in the constructor. When the address of those variables is updated through `updateMarketingWallet()` and `updateTreasuryWallet()` functions, the exemptions are not granted to the new addresses nor are they revoked from the previous addresses.

Privilege not Revoked or Transferred

The following checks are missing:
- `account` address passed as the input to `_tokengeneration()` is not zero-checked.
- the return value `_pair` of `createPair()` function call is not zero-checked.
- `_newWallet` address passed as the input to `updateMarketingWallet()` is not zero-checked.
- `_newWallet` address passed as the input to `updateTreasuryWallet()` is not zero-checked.
- `_address` address passed as the input to `updateExemptFee()` is not zero-checked.
- `_accounts` addresses passed as the input to `bulkExemptFee()` are not zero-checked.
- `weiAmount` passed to `rescueETH()` should be greater than zero and less than or equal to the contract's ETH balance.
- `_amount` passed to `rescueERC20Tokens()` should be greater than zero and less than or equal to the contract's token balance.
- `_tokenAdd` address passed as the input to `rescueERC20Tokens()` is not zero-checked.
- `tokenAmount` passed to `swapTokensForETH()` should be greater than zero.

Missing checks or input validations

State variables that never change should be declared as `constant` to save gas. In the `Aven` contract `launchtax` should be declared `constant`.

---
Furthermore the following addresses can be explicitly assigned to a constant variable:
- `0xD152f549545093347A162Dce210e7293f1452150` at line 442
- `0x407993575c91ce7643a4d4cCACc9A98c36eE1BBE` at line 443
- `0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D` at line 432


State Variable Should Be Declared Constant

The mapping `_lastSell` in `Aven` is never used.

Unused State Variable

The linked `pair` variable assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Variables That Could Be Declared as Immutable

In `_transfer()` function `currentTaxes` local variable is not initialized.

Uninitialized Local Struct

The following functions in `Aven` contract are redundant, since their behavior is the same of the inherited version from `ERC20` contract:
- `approve()` at line 447
- `transferFrom()` at line 452
- `increaseAllowance()` at line 466
- `decreaseAllowance()` at line 475
- `transfer()` at line 487

Redundant Functions

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. It says:
- `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers
- `UPPER_CASE`: Should be applied to `constant` variables
- `CapWords`: Should be applied to contract names, struct names, event names and enums

In the contract `Aven`:
- Function `_tokengeneration` is not in `camelCase`.
- Variable `genesis_block` is not in `camelCase`.
- Constant variable `deadWallet` is not in `UPPER_CASE`.
- Function `Liquify` is not in `camelCase`
- Function `SetBuyTaxes` is not in `camelCase`.
- Function `SetSellTaxes` is not in `camelCase`.



Declaration Naming Convention

At line 68 `defaut` is written instead of `default`.

Typo

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

Private or internal functions should have `_` as name prefix.

Missing `_` as Name Prefix to `private` or `internal` functions

Function `SetBuyTaxes()` is meant to update the current value of `taxes` state variable. `taxes` is intended to be used as the fee not only for buy transfers from the `pair` but also for any transfer when `useLaunchFee` is false and the recipient is not the `pair`. 

Misleading Function Name

`_transfer()` function has the following issues:
- At line 513 there is no need to assign zero to `fee`. The variable is already initialized to zero and its value is always updated at line 532.
- There is no need to calculate the fee amount twice: one at line 532 and another time at line 543. The local variable `fee` already contains the fee amount to be sent.
- There is no need to have to nested if-conditions at lines 539 and 542. If `fee` is greater than zero, then it can be sent directly and it is unnecessary to check that `feeswap` is greater than zero.

Issues in `_transfer()` function

Aven Token

Aven.sol

Formal Verification

Aven Global offers a distinctive solution for secure investments and rewards, including AvenDao, AvenSecurity, and AvenWallet among their products.

Aven Global

Cathie Wood: Bitcoin and Ethereum are ‘on the right track,’ despite collapse of several crypto companies

Trump’s NFT Digital Trading Cards Bring in Millions of Dollars—and GOP Ridicule - WSJ

Hermès Wins Case Against Artist Who Sold NFTs of Birkin Bags

Cathie Wood: Bitcoin and Ethereum are ‘on the right track,’ despite collapse of several crypto companies - MarketWatch

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

3 reasons why it could be a rocky week for Bitcoin, Ethereum and altcoins

Candy Digital NFT shop lays off large number of employees amid market deterioration

Ethereum price hits $1.6K as markets expect the FED to ease the pressure

Ethereum rallies to $1,350, but derivatives metrics remain neutral to bearish

DefiLlama founder moves to NFT lending to tackle liquidity constraints

Bitcoin, Ethereum, Crypto News and Price Data - CoinDesk

Critics can’t stop NFTs from becoming a mainstay of daily life

"Ethereum Killer" Solana's Top Spot Threatened by FTX Drama and Emergence of Strong Opponent

Bitcoin, Ethereum And The FTX Collapse

Cryptocurrency Tax 2022-2023: Your Crypto Tax Bill With Bitcoin, NFT Losses

Bridge Champ Introduces NFT Badges and Crypto Rewards, New Roadmap Says

Ethereum derivatives look bearish, but traders believe the ETH bottom is in

CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data

Aven Global Token

Want To Know How CertiK Performs An Audit?

Want To Secure Your Wallet, Exchange or Dapp? Check Out Our Web 3 Pentesting

Aven Global

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

16

0

16

0

0

Products & Technology

Bug Bounty

Smart Contract Audit

SkyTrace

L1 Chain Audit

Incident Response

Skynet

KYC

Advisory Services

Penetration Testing

Sky Harbor

Formal Verification

Featured Ecosystems

BNB Chain

Ethereum

Avalanche

Solana

Algorand

NEAR

Cosmos

Polygon

Aptos

Company

About

Testimonials

Partnership

We're Hiring

Disclaimer

Resources

Aven Global

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

16

0

16

0

0