Read the findings of the 2022 Web3 Security Report

In the contract `Auth` the role `owner` has authority over the functions listed below.
- `transferOwnership`: manage the state variable `owner`
- `unauthorize`: manage the state variable `authorizations`
- `authorize`: manage the state variable `authorizations`

Any compromise to the `owner` account may allow the hacker to take advantage of this authority.

In the contract `ELONPETS` the role `owner` has authority over the functions shown listed below.
- `setMaxWalletPercent_base1000`: manage the state variable `_maxWalletToken`
- `setMaxTxPercent_base1000`: manage the state variable `_maxTxAmount`
- `clearStuckBalance`: call the function `transfer`
- `clearStuckToken`: call the function `transfer`
- `tradingStatus`: manage the state variables `tradingOpen` and `antibot`
- `tradingStatus_launchmode`: manage the state variable `launchMode`
- `manage_blacklist_status`: manage the state variable `blacklistMode`
- `manage_blacklist`: manage the state variable `isBlacklisted`
- `setFees`: manage the state variables `liquidityFee`, `marketingFee`, `devFee`, `utilityFee`, `totalFee`
- `setFeeReceivers`: manage the state variables `autoLiquidityReceiver`, `marketingFeeReceiver`, `utilityFeeReceiver`, `devFeeReceiver`
- `setSwapBackSettings`: manage the state variables `swapEnabled`, `swapThreshold`
- `setTargetLiquidity`: manage the state variables `targetLiquidity`, `targetLiquidityDenominator`
- `multiTransfer`: call the function `_basicTransfer`


Any compromise to the `owner` account may allow the hacker to take advantage of this authority, change the configuration of this contract, and transfer tokens in the contract.

In the contract `ELONPETS` the role `authorizations` has authority over the functions shown listed below.
- `setTxLimit`: manage the state variable `_maxTxAmount`
- `setMultipliers`: manage the state variables `sellMultiplier`, `buyMultiplier`, `transferMultiplier`
- `manage_FeeExempt`: manage the state variable `isFeeExempt`
- `manage_TxLimitExempt`: manage the state variable `isTxLimitExempt`
- `manage_WalletLimitExempt`: manage the state variable `isWalletLimitExempt`

Any compromise to the `authorizations` account may allow the hacker to take advantage of this authority, and change the configuration of this contract.

Centralization Risks in ELONPETS.sol

All of the ElonPets tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute ElonPets tokens without obtaining the consensus of the community.

Initial Token Distribution

Over time, these accounts `utilityFeeReceiver`, `marketingFeeReceiver`, and `devFeeReceiver` will accumulate a significant amount of tokens or BNB.
```solidity=
_balances[utilityFeeReceiver] = _balances[utilityFeeReceiver].add(utilityTokens);

payable(marketingFeeReceiver).transfer(amountBNBMarketing);
payable(devFeeReceiver).transfer(amountBNBDev);
```


Centralization Risk in Fee Receiver

```solidity=
router.addLiquidityETH{value: amountBNBLiquidity}(
    address(this),
    amountToLiquify,
    0,
    0,
    autoLiquidityReceiver,
    block.timestamp
);
```

The `swapBack` function calls the `router.addLiquidityETH` function with the `to` address specified as `autoLiquidityReceiver` for acquiring the generated LP tokens from the `ElonPets-BNB` pool. As a result, over time the `autoLiquidityReceiver` address will accumulate a significant portion of LP tokens. If the `autoLiquidityReceiver` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences for the project as a whole. 


Centralized risk in `swapBack`

The contract is serving as the underlying entity to interact with third-party PancakeSwap protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

File: ELONPETS.sol (Line 470, Function `ELONPETS.setFeeReceivers`)
```solidity
        autoLiquidityReceiver = _autoLiquidityReceiver;
```
- `_autoLiquidityReceiver` is not zero-checked before being used.


---
File: ELONPETS.sol (Line 471, Function `ELONPETS.setFeeReceivers`)
```solidity
        marketingFeeReceiver = _marketingFeeReceiver;
```
- `_marketingFeeReceiver` is not zero-checked before being used.


---
File: ELONPETS.sol (Line 472, Function `ELONPETS.setFeeReceivers`)
```solidity
        utilityFeeReceiver = _utilityFeeReceiver;
```
- `_utilityFeeReceiver` is not zero-checked before being used.


---
File: ELONPETS.sol (Line 473, Function `ELONPETS.setFeeReceivers`)
```solidity
        devFeeReceiver = _devFeeReceiver;
```
- `_devFeeReceiver` is not zero-checked before being used.



Missing Zero Address Validation

The passed-in value `transferMultiplier` is missing a range check.


Missing Input Validation

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

The return values of function  `addLiquidityETH` are not properly handled.

```solidity=
router.addLiquidityETH{value: amountBNBLiquidity}(
  address(this),
  amountToLiquify,
  0,
  0,
  autoLiquidityReceiver,
  block.timestamp
);
```

Return value not handled

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

ElonPets

ElonPets

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

11

0

0