Read the findings of the 2022 Web3 Security Report

In the contract `BitcoinAsset`, the role `_owner` has authority over the following functions:

- `excludeMultipleAccountsFromFees()`
- `setSwap()`
- `SetMinSwap()`
- `manualswap()`
- `manualsend()`
- `setNewRouterAddress()`
- `reserverAddressUpdated()`
- `tokensRescued()`
- `renounceOwnership()`

Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and for example, steal all ETH and tokens from the contract using `rescueForeignTokens()` and `manualsend()`, set the `_reserverAddress` to an address he/she controls, which can be used to receive ether and fees.
The hacker can then renounce ownership of the contract, making it impossible to change the `_reserverAddress` again.

----

In the contract `BitcoinAsset`, the role `_reserverAddress` has authority over the following functions:

- `manualswap()`
- `manualsend()`

Any compromise to the `_reserverAddress` account may allow a hacker to take advantage of this authority and call the aforementioned functions to manually withdraw all ETH from the contract and swap tokens without restrictions.

Centralization Related Risks

All of the tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

The order of external call/transfer, storage manipulation, and event emission must follow the check-effect-interaction pattern.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

Check Effect Interaction Pattern Violated

In the function `rescueForeignTokens()`, the return value of the `transfer()`/`transferFrom()` call is not checked.

Unchecked ERC-20 `transfer()`/`transferFrom()` Call

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

Missing Zero Address Validation

The function `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens()` in the aforementioned lines is executed without setting restrictions on slippage, which would make the swapping and liquidity-adding processes sensitive to price fluctuation from the DEX. In this case, it would be vulnerable to potential sandwich attacks, and thus the project might suffer unexpected losses.

Potential Sandwich Attack

The name of the function `sendFee()` lets think that only a percentage of the contract balance will be transfered, however in the function `_transfer()`, the totality of ETH in the contract will be transferred to the `_reserverAddress`.

Misleading Function Name 

The version of the `SafeMath` library used in the codebase is not in its optimal state.

Outdated `SafeMath` Version

State variables that never change should be declared as `constant` to save gas.

State Variable Should Be Declared Constant

The following state variables are never used in the codebase.

- `_previousOwner`
- `_tOwned`

Unused State Variables

The functions which are never called internally within the contract should have external visibility for gas optimization.

Function Should Be Declared `external`

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

The function that affects the status of sensitive variables should be able to emit events as notifications.
- `setSwap()`
- `excludeMultipleAccountsFromFees()`

Missing Emit Events

Bitcoin Asset

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

13

0

12

1

0