Read the findings of the 2022 Web3 Security Report

In the contract `BKingToken` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/3c885176a0c746e9b1e3327d74c461ff/diagrams/centralization_BKingToken__owner.svg)

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/3c885176a0c746e9b1e3327d74c461ff/diagrams/centralization_Ownable__owner.svg)

Centralization Risks in BKingToken.sol

`_tTotal` tokens were sent to the `holder` when deploying the contract. 
This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

The sum of the array `txFeeConfig` is equal to 8 and `fee.txFee` is equal to 7. More tokens are added to the addresses in the array `lastTxArr`, so the contract generates more tokens.

Incorrect Calculation For `_takeLastTx`

The `addLiquidity` function calls the `uniswapV2Router.addLiquidityETH` function with the `to` address specified as `holder` for acquiring the generated LP tokens from the `BKing-BNB` pool. As a result, over time the `holder` address will accumulate a significant portion of LP tokens. If the `holder` is an EOA (Externally Owned Account), mishandling its private key can have devastating consequences for the project as a whole.

Centralized risk in `addLiquidity`

The function `_takeLucky` gives a reward to the address in the `lastLuckyArr` array, but the token does not subtracted from `address(this)`.

Token Not Subtracted From `address(this)`

The above function does not check for `end` less than `count`.

Missing Condition Check

The contract is serving as the underlying entity to interact with third-party protocols. The scope of the audit would treat those 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties may be compromised and lead to assets being lost or stolen.

Third Party Dependencies

The given input is missing the check for the non-zero address.

Lack of Zero Address Validation

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens()`
- `uniswapV2Router.addLiquidityETH()`
- `uniswapV2Router.swapExactTokensForTokensSupportingFeeOnTransferTokens()`

Potential Sandwich Attacks

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

Missing Emit Events

The linked variables could be declared as `constant` since these state variables are never modified.

Set `constant` to Variables

`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.

Function Visibility Optimization

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Set `immutable` to Variables

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

Literals with many digits are difficult to read and review.

Too Many Digits

The linked variable declarations do not have a visibility specifier explicitly set.

Visibility Specifiers Missing

The return values of function  `addLiquidityETH` is not properly handled.

```solidity
uniswapV2Router.addLiquidityETH{value: ethAmount}(
    address(this),
    tokenAmount,
    0, // slippage is unavoidable
    0, // slippage is unavoidable
    holder,
    block.timestamp
);
```

Return value not handled

Line 796 of the code does not check if `to` is equal to `uniswapV2Router`, and line 806 of the code has the same issue.

Beast king

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

19

0

19

0

0