Kiba Inu

In the contract `KibaInu` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and be able to change AutoLPBurnSettings, disable the transfer delay, enable trading, change any of the fees, change maximum transaction and wallet amounts, change the wallet addresses that fees and LP tokens are set to, blacklisted accounts, add AMM pairs, and remove limits.
![](https://accelerator-tasks-prod.s3.amazonaws.com/fa62e80faa224476b3139c867cca5224/diagrams/centralization_KibaInu__owner.svg)

Centralization Risks in KibaInu.sol

In the `manualBurnLiquidityPairTokens()` and `addLiquidity()`, the burned tokens and LP tokens are sent to `deadAddress` which is an externally owned address. The address owner can use the tokens to get profit.

`deadAddress` is an externally owned address

All of the KIBA tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute KIBA tokens without obtaining the consensus of the community.

Initial Token Distribution

When calculating `ethForMarketing` and `ethForDev` an incorrect formula is used. For example assume `tokensForLiquidity=4`, `tokensForMarketing=3`, and `tokensForDev=3`. Then `totalTokensToSwap` is calculated to be `4+3+3=10`, so that `ethForMarketing` and `ethForDev` will be `3/10` of the `ETH` swapped for. When it should be `3/8` of the `ETH` swapped for each as only half of the liquidity tokens are swapped. 

Incorrect Math Formula

`tx.origin` can be spoofed by the attacker. That allows to avoid transfer delays or block the transfers for another user.

Dangerous Usage of `tx.origin`

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

The function `_transfer()` can be reentered.

### External call(s)
```solidity
            swapBack();
            autoBurnLiquidityPairTokens();
```
* These functions execute the following external call(s):
* In `KibaInu.addLiquidity`,
    * `uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this),tokenAmount,0,0,deadAddress,block.timestamp)`
* In `KibaInu.swapTokensForEth`,
    * `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount,0,path,address(this),block.timestamp)`
* In `KibaInu.swapBack`,
    * `(success,None) = address(devWallet).call{value: ethForDev}()`
* In `KibaInu.swapBack`,
    * `(success,None) = address(marketingWallet).call{value: address(this).balance}()`
* This call sends Ether.

### State variables written after the call(s)
```solidity
            swapping = false;
            tokensForDev += fees * sellDevFee / sellTotalFees;
            tokensForDev += fees * buyDevFee / buyTotalFees;
            tokensForLiquidity += fees * sellLiquidityFee / sellTotalFees;
```


Potential Reentrancy Attack

The `_transfer()` function requires `to` to not be the zero address. It is then used in part of an `if` statement.

Redundant Check in `_transfer()`

The contract is serving as the underlying entity to interact with third party Automated Market Maker protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

Addresses should be checked before assignment or external call to make sure they are not zero addresses.


Missing Zero Address Validation

There are two functions designed to update the mapping `_blacklist`.
- `blacklistAccount()`
- `setKibaModifier()`
  
The only difference is that one is `external` and the other `public`, however, neither is used in the contract.

Using Multiple Functions to Update `_blacklist`

The address `0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D` is stored in `uniswapV2Router`, but used in `_transfer()`.

Router Address Hardcoded Twice

The event `UpdateUniswapV2Router` is never used in the contract.

Event Not Used

The naming convention for private and internal functions as well as private variables is to start with an "_". The aforementioned functions and variables do not follow this convention.

Declaration Naming Convention

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

Improper Usage of `public` and `external` Type

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The linked variables could be declared as `constant` since these state variables are never modified.

`manualBurnFrequency` Can Be Declared as `constant`

Literals with many digits are difficult to read and review.

```solidity=1047
        require(newAmount >= totalSupply() * 1 / 100000, "Swap amount cannot be lower than 0.001% total supply.");
```

Too Many Digits

State variables that never change should be declared as `constant` to save gas.

File: KibaInu.sol (Line 876, Contract `KibaInu`)
```solidity
    uint256 public manualBurnFrequency = 30 minutes;
```
- `manualBurnFrequency` should be declared `constant`.



State Variable Should Be Declared Constant

```solidity=966
        uint256 totalSupply = 1 * 1e12 * 1e18;
```
Local variable `totalSupply` shadows the function `totalSupply()` in `ERC20`.

Shadowing Local Variable

There are redundant variables defined and then set equal to other variables. For example can just use `buyMarketingFee=5` and not have to define a new variable `_buyMarketingFee`.

Redundant variables

The emitted event `swapAndLiquify` has the argument `tokensForLiquidty` which is `0`.

Incorrect Argument Value

There are magic numbers used to calculate fees and thresholds. 

Exchange	Pair	Price	Spread	24H Volume	24H Vol USD	Volume %

No Data

	Address	Percentage	Quantity	Value

No Data

Tx Hash	Caller	Contract	Function	Timestamp

No Data

Kiba Inu

Highlights & Alerts

A Highly Centralized Project

Audit History

Skynet

Sentiment Analysis

Market Volatility

On-chain Monitoring

Performance Summary

On-chain Data Charts

Governance & Autonomy

Token Holder Distribution Analysis

Top 100 Token Holders