Read the findings of the 2022 Web3 Security Report

The contract is serving as the underlying entity to interact with third party protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

In the contract `Ownable`, the role `owner` has the authority over the following function:
- renounceOwnership
- transferOwnership

In the contract `JoinCoin`, the role `owner` has the authority over the following function:
- enableTrading
- removeLimits
- disableTransferDelay
- airdropToWallets
- updateSwapTokensAtAmount
- updateMaxAmount
- excludeFromMaxTransaction
- updateSwapEnabled
- updateBuyFees
- updateSellFees
- excludeFromFees
- setAutomatedMarketMakerPair
- updateMarketingWallet
- updateLiquidityWallet
- withdrawStuckETH

In the contract `JoinCoin`, the `liquidityWallet` can receive LP tokens. The accounts `marketingWallet`, `stakingAddress`, `friendlyWhaleWallet`, `devWallet` can receive BNB from contract.

Any compromise to these accounts may allow a hacker to take advantage of this authority.

Centralization Related Risks

The contract `JoinCoin` is a DeFi token deployed on Binance smart chain(BSC).

If both sender and receiver are not excluded from fee, each buy or sell transaction will be charged fees, including market fee, liquidity fee, dev fee, staking fee and friendly whale fee. The buy and sell fees can be set differently by owner at any time. All the fees will be sent to contract first. When meeting certain conditions, they will be used to add liquidity and be converted to BNB. The LP token is for `liquidityWallet`. The converted BNB is sent to market, dev, staking and friendly whale wallets according fee rates. It should be noted that all these wallets are initialized as owner account and the dev, staking and friendly whale wallets can not be changed any more.

Financial Models

The `stakingAddress`, `friendlyWhaleWallet`, `devWallet` are three privileged wallets and can receive BNB from contract. However, they are initialized as owner account in constructor and can never be changed any more. Please make sure this meets your intention.

Unchangeable Wallet Address

The amount of `totalSupply` tokens that are minted to the centralized address `msg.sender` who is `owner`,  may raise the community's concerns about the centralization issue.

Token Minted To Centralized Address

The `airdropWallets.length < 200` means at most 199 wallets can be airdropped per transaction. This might be inconsistent with the error message. 
```solidity=885
require(airdropWallets.length < 200, "Can only airdrop 200 wallets per txn due to gas limits");
```

The `buyTotalFees <= 10` means at most 10% buy fee can be set. This might be inconsistent with the error message. 
```solidity=923
require(buyTotalFees <= 10, "Must keep fees at 20% or less");
```

Inconsistent Between Code and Error Message

The following functions that affect the status of sensitive variables should be able to emit events as notifications to users.
- enableTrading
- removeLimits
- disableTransferDelay
- updateSwapTokensAtAmount
- updateMaxAmount
- updateSwapEnabled
- updateBuyFees
- updateSellFees

Missing Emit Events

The given input is missing the check for the non-zero address.

Missing Input Validation

The `liquidityWallet` is excluded from fee and max transaction in the constructor. However, function `updateLiquidityWallet` does not update these two related states.

Related States Not Updated

It is unnecessary to transfer amount 0 to another account.

Transfer Amount Zero

1. The judgment conditions at Line 973 already include the judgment conditions at Line 984.
2. The if-condition at Line 983 and Line 999 are the same.

Redundant code

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens()
- uniswapV2Router.addLiquidityETH()

Potential Sandwich Attacks

```solidity=1100
// add the liquidity
uniswapV2Router.addLiquidityETH{value: ethAmount}(
    address(this),
    tokenAmount,
    0, // slippage is unavoidable
    0, // slippage is unavoidable
    liquidityWallet,
    block.timestamp
);
```

The `addLiquidity` function calls the `uniswapV2Router.addLiquidityETH` function with the `to` address specified as `liquidityWallet` for acquiring the generated LP tokens from the `JOIN-BNB` pool. As a result, over time the `liquidityWallet` address will accumulate a significant portion of LP tokens.If the `liquidityWallet` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences to the project as a whole.

Centralized Risk in `addLiquidity`

The `ethForMarketing`, `ethForDev`, `ethForStaking` and `ethForFriendlyWhale` are calculated mistakenly. The correct `ethForMarketing` is `ethBalance * tokensForMarketing / (totalTokensToSwap - tokensForLiquidity / 2)`, so does the `ethForDev`, `ethForStaking` and `ethForFriendlyWhale`.

Miscalculation in `swapBack()`

In function `swapBack()`, event `SwapAndLiquify` is emitted mistakenly. The `tokensForLiquidity` is set as zero at Line 1140. It is falsely used in the event.
```solidity=1152
emit SwapAndLiquify(amountToSwapForETH, ethForLiquidity, tokensForLiquidity);
```

Join

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

15

0

0