Sign Up for a Code Audit Today and Get 3 Months of Skynet for Free

onPlanet.transferBalance(address)._transferWallet (onPlanet.sol#451) lacks a zero-check on :
		- _transferWallet.transfer(address(this).balance) (onPlanet.sol#452)

onPlanet.setMarketingAddress(address)._marketingAddress (onPlanet.sol#978) lacks a zero-check on :
		- marketingAddress = address(_marketingAddress) (onPlanet.sol#979)

onPlanet.setDeveloperAddress(address)._devAddress (onPlanet.sol#982) lacks a zero-check on :
		- devAddress = address(_devAddress) (onPlanet.sol#983)

onPlanet.setBuyBackTokenAddress(address)._addr (onPlanet.sol#1016) lacks a zero-check on :
		- _buyback_token_addr = _addr (onPlanet.sol#1017)

Missing-Zero-Check

onPlanet.setBuybackUpperLimit(uint256,uint256) (onPlanet.sol#364-371) performs a multiplication on the result of a division:
	-buyBackUpperLimit = buyBackLimit.div(10 ** numOfDecimals).mul(10 ** 18) (onPlanet.sol#369)

onPlanet.setBuybackMinAvailability(uint256,uint256) (onPlanet.sol#385-392) performs a multiplication on the result of a division:
	-buyBackMinAvailability = amount.div(10 ** numOfDecimals).mul(10 ** 18) (onPlanet.sol#390)


Divide-Before-Multiply

```solidity=761
    function includeInReward(address account) external onlyOwner() {
        require(_isExcluded[account], "Account is already excluded");
        for (uint256 i = 0; i < _excluded.length; i++) {
            if (_excluded[i] == account) {
                _excluded[i] = _excluded[_excluded.length - 1];
                _tOwned[account] = 0;
                _isExcluded[account] = false;
                _excluded.pop();
                break;
            }
        }
    }
```

Variable `_rOwned[account]` is not updated in the function `includeInReward()`, which will make the accounts included siphon off the tokens out of the balances of all token holders.

Details: [Link](https://perafinance.medium.com/safemoon-is-it-safe-though-a-detailed-explanation-of-frictionless-yield-bug-338710649846)

Variable `_rOwned[account]` Not Updated in Function `includeInReward()`

All of the OP tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute these tokens without obtaining the consensus of the community.

Initial Token Distribution

```solidity=1020
    function updateStakingAddress(address _addr) public onlyOwner {
        stakingAddress = _addr;
        emit StakingAddressUpdated(_addr);
    }
```
`stakingAddress` is the address to receive tokens. It is set to DEAD address by default. 

However, this could still be a centralization risk because the address can be updated to any address by calling function `updateStakingAddress()`.

Changeable Tokens Receiver

```solidity=347
    transferToAddressETH(marketingAddress, transferredBalance.mul(_teamFee).div(_buybackFee + _teamFee).div(2));
    transferToAddressETH(devAddress, transferredBalance.mul(_teamFee).div(_buybackFee + _teamFee).div(2));
```
`_buybackFee + _teamFee` equaling 0 would lead to a division by 0 error.

Potential Division by 0

```solidity=364
    function setBuybackUpperLimit(uint256 buyBackLimit, uint256 numOfDecimals)
        external
        onlyBuybackOwner
    {
        uint256 prevValue = buyBackUpperLimit;
        buyBackUpperLimit = buyBackLimit.div(10**numOfDecimals).mul(10**18);
        emit BuybackUpperLimitUpdated(prevValue, buyBackUpperLimit);
    }
```
```solidity=974
     function setBuybackUpperLimit(uint256 buyBackLimit) external onlyOwner() {
        buyBackUpperLimit = buyBackLimit * 10**18;
    }
```
There is no lower boundary for variable `buyBackUpperLimit`. If its value is 0, function `buyBackTokens()` will never be triggered because the value of variable `nextBuybackAmount` will always be 0. 

```solidity=970
    function setNumTokensSellToAddToLiquidity(uint256 _minimumTokensBeforeSwap) external onlyOwner() {
        minimumTokensBeforeSwap = _minimumTokensBeforeSwap;
    }
```
Also, there is no lower boundary for variable `minimumTokensBeforeSwap`, if its value is 0, OP tokens would not be swapped to other tokens.

Lack of Lower Boundary

```solidity=373
    function setBuybackTriggerTokenLimit(uint256 buyBackTriggerLimit)
        external
        onlyBuybackOwner
    {
        uint256 prevValue = buyBackTriggerTokenLimit;
        buyBackTriggerTokenLimit = buyBackTriggerLimit;
        emit BuyBackTriggerTokenLimitUpdated(
            prevValue,
            buyBackTriggerTokenLimit
        );
    }

    function setBuybackMinAvailability(uint256 amount, uint256 numOfDecimals)
        external
        onlyBuybackOwner
    {
        uint256 prevValue = buyBackMinAvailability;
        buyBackMinAvailability = amount.div(10**numOfDecimals).mul(10**18);
        emit BuybackMinAvailabilityUpdated(prevValue, buyBackMinAvailability);
    }
```
There are no upper boundaries for `buyBackTriggerTokenLimit` and `buyBackMinAvailability`. Function `buyBackTokens()` will never be triggered if the values of these variables are too large.

Lack of Upper Boundary

Function `buyBackTokens()`:
```solidity=315
    function buyBackTokens(uint256 amount) private lockTheSwap {
        if (amount > 0) {
            if(ethBuyBack){
                swapETHForTokensNoFee(
                    address(this),
                    stakingAddress,
                    amount
                );
            }else{
                swapTokensForTokens(
                    _buyback_token_addr,
                    address(this),
                    stakingAddress,
                    amount
                );
            }
        }
    }
```
And a code snippet in function `_transfer()`:
```solidity=495
            if (buyBackEnabled && address(this).balance > buyBackMinAvailability 
                && buyVolume.add(sellVolume) > buyBackTriggerVolume) 
            {
                if (nextBuybackAmount > address(this).balance) {
                    nextBuybackAmount = address(this).balance;
                }

                if (nextBuybackAmount > 0) {
                    buyBackTokens(nextBuybackAmount);
                    nextBuybackAmount = 0; //reset the next buyback amount
                    buyVolume = 0; //reset the buy volume
                    sellVolume = 0; // reset the sell volume
                }
```
When variable `ethBuyBack` is false, function `buyBackTokens()` would trigger function `swapTokensForTokens()` to swap `_buyback_token_addr` (default token: BUSD) for OP tokens.

Function `buyBackTokens()` takes variable `nextBuybackAmount` as a parameter, and the value of `nextBuybackAmount` depends on the eth balance of the contract. So function `buyBackTokens()` could revert because the contract may NOT have enough BUSD. As a result, function `_transfer()` would revert.

Logical Issue in Function `_transfer()`

```solidity=430
    function inTradingStartCoolDown() public view returns (bool) {
        // Trading has been started and the cool down period has elapsed
        return tradingStartCooldown >= block.timestamp;
    }
```
The function `inTradingStartCoolDown()` does NOT check if trading has been started.

Ineffective Function `inTradingStartCoolDown()`

```solidity=451
    function transferBalance(address payable _transferWallet) external onlyOwner {
        _transferWallet.transfer(address(this).balance);
    }
```
The role `_owner` can transfer BNB to any account by calling function `transferBalance()`. Any compromise to the `_owner` account may allow the hacker to take advantage of this and damage the tokenomics.

Centralization Risk in Function `transferBalance()`

```solidity=996
    function setReflectionEnabled(bool _enabled) public onlyOwner {
        isReflection = _enabled;

        if(isReflection){
            for (uint256 i = 0; i < _excluded.length; i++) {
                _tOwned[_excluded[i]] = 0;
                _isExcluded[_excluded[i]] = false;
                _excluded.pop();
            }
        }else{
            for(uint256 i = 0; i < hodler.length; i++){
                if(_rOwned[hodler[i]] > 0) {
                    _tOwned[hodler[i]] = tokenFromReflection(_rOwned[hodler[i]]);
                }
                _isExcluded[hodler[i]] = true;
                _excluded.push(hodler[i]);
            }
        }
    }
```
```solidity=774
    function _tokenTransfer(address sender, address recipient, uint256 amount,bool takeFee) private {
        if(!takeFee)
            removeAllFee();
        
        if (_isExcluded[sender] && !_isExcluded[recipient]) {
            _transferFromExcluded(sender, recipient, amount);
        } else if (!_isExcluded[sender] && _isExcluded[recipient]) {
            _transferToExcluded(sender, recipient, amount);
        } else if (_isExcluded[sender] && _isExcluded[recipient]) {
            _transferBothExcluded(sender, recipient, amount);
        } else {
            _transferStandard(sender, recipient, amount);
        }
        
        if(!_isHodler[recipient] && amount > 0){
            _isHodler[recipient] = true;
            hodler.push();
        }
        restoreAllFee();
    }
```
Function `setReflectionEnabled()` would NOT work as desired because the array `hodler` pushes zero-initialized element (not an holder's address) in function `_tokenTransfer()`.

Ineffective Function `setReflectionEnabled()`

Variable `multiFeeOn` is NOT in use except the setting function.

Also, some variables about fee rates can be updated by calling functions `setDefaultInFeePercent()` and `setDefaultOutFeePercent()`.

However, these variables are never used to charge fees.
```solidity=938
    function setDefaultInFeePercent(uint256 tax, uint256 buyback, uint256 team) external onlyOwner() {
        _inTaxFee = tax;
        _inBuybackFee = buyback;
        _inTeamFee = team;
    }

    function setDefaultOutFeePercent(uint256 tax, uint256 buyback, uint256 team) external onlyOwner() {
        _outTaxFee = tax;
        _outBuybackFee = buyback;
        _outTeamFee = team;
    }
```

Unused Variables

A code snippet in function `setReflectionEnabled()`
```solidity=1000
            for (uint256 i = 0; i < _excluded.length; i++) {
                _tOwned[_excluded[i]] = 0;
                _isExcluded[_excluded[i]] = false;
                _excluded.pop();
            }
```
In the for loop, function `_excluded.pop()` can only remove the last element rather than the account `_excluded[i]` in the array `_excluded`.

Also, the condition of the for loop is `i < _excluded.length`. Since the length of the array `_excluded` shrinks, the function cannot include all excluded accounts.

Logical Issues in Function `setReflectionEnabled()`

```solidity=1025
    function _onPlanetEcosystemContractAdd(address contractAddress) private {
        _isOnPlanetEcosystemContract[contractAddress] = true;
        allEcosystemContracts.push(contractAddress);

        emit OnPlanetEcosystemContractAdded(contractAddress);
        excludeFromFee(contractAddress);
    }
```
Function `_onPlanetEcosystemContractAdd()` is private and never be used by other functions. So the function cannot be called in this contract.

Private Function `_onPlanetEcosystemContractAdd()`

In the contract `onPlanet`, the role `_owner` has the authority over the functions shown in the diagram below.

Any compromise to the privileged account which has access to `_owner` may allow the hacker to take advantage of this and damage the tokenomics.

![](https://accelerator-tasks-prod.s3.amazonaws.com/7e9457280637403a888a196dbc906373/onPlanet-_owner.svg)

Centralization Risk in onPlanet.sol

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Fee rates `_taxFee`, `_buybackFee`, and `_teamFee` are not initialized in function `setTradingEnabled()`. No fee would be charged until `restoreAllFee()` is called. So the first transfer would not be charged.

Fee Rates NOT Initialized in Function `setTradingEnabled()`

Using unit-test to test smart contracts is one of the best ways to identify potential logic errors and security vulnerabilities in the smart contract. No unit-test file was found in the provided GitHub code repository. Based on the number of issues discovered in the audit, it shows that the smart contract suffers from the lack of unit testing and quality control. 

onPlanet

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

19

0

4

0

15