Read the findings of the 2022 Web3 Security Report

In the contract `Auth` the role `_owner` has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/5f1e496488c1423db25d64df7cbf3413/diagrams/centralization-Auth-_owner.svg)

In the contract `DividendDistributor` the role `_token` has authority over the functions shown in the diagram below.

Any compromise to the `_token` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/5f1e496488c1423db25d64df7cbf3413/diagrams/centralization-DividendDistributor-_token.svg)

In the contract `StableGrow` the role `authorized` has authority over the function shown in the list below.

Any compromise to the `authorized` account may allow the hacker to take advantage of this authority, and any transaction will be blocked if the variable `_maxTxAmount` is set as zero, or the transaction address is set `false` in variable `blackListed[]`, or the state variable `start` is modified to `false`.

- `setAutoBuybackSettings`,
- `SolarFlare`, buyBack tokens manually
- `launch()`,`startTrading()`
- `setIsDividendExempt()`, `setIsFeeExempt()`, `setIsTxLimitExempt()`,`setBlacklisted()`, `setTxLimit`
- `burnTokens`
- `setFees()`, `setFeeReceivers`
- `setSwapBackSettings`
- `setTargetLiquidity`
- `setDistributionCriteria`
- `setDistributorSettings`

Centralization Related Risks

```solidity=480
uint256 distributorGas = 500000;
```

```solidity=571
try distributor.process(distributorGas) {} catch {}
```

At the last step of function `_transferFrom` will call `distributor.process` with constant gas limitation `500000`. But there may be not enough 500 thousand gas till this step. EVM may revert this call and return the out-of-gas exception.

Potential Out-of-Gas Exception

```solidity=659
router.addLiquidityETH{value: amountBNBLiquidity}(
  address(this),
  amountToLiquify,
  0,
  0,
  autoLiquidityReceiver, 
  block.timestamp
);
```

The `addLiquidity` function calls the `pancakeSwapV2Router.addLiquidityETH` function with the `autoLiquidityReceiver` address specified as `authorized` for acquiring the generated LP tokens from the `SGC-BNB` pool. As a result, over time the `authorized` address will accumulate a significant portion of LP tokens. If the `authorized` is an EOA (Externally Owned Account), mishandling its private key can have devastating consequences for the project as a whole.


Centralization risk in `addLiquidity`

A large portion of the BNB swapped in the `swapBack` method is not allocated. Various fees are calculated with default values:

1. amountBNB is the number of BNBs swapped by the `swapThreshold` amount of 14/15 of the SGC tokens.
2. amountBNBLiquidity is amountBNB * 1 / 14, amountBNBReflection is amountBNB * 2 / 14, amountBNBMarketing is amountBNB * 3 / 14.
3. The number of remaining BNBs in this wap is amountBNB * 8 / 14.

In normal logic, the left BNBs is to buyBack tokens, but in the function `TransferBNBsOutfromContract`, the role `authorized` can transfer any amount of BNBs in the current contract to any address. 

Any compromise to the `authorized` account may allow the hacker to take advantage of this and make the contract invoke malicious code, and steal funds from the contract. Thus breaking the repurchase mechanism.

Potential rug-pull privileged

All of the `SGC` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute all tokens without obtaining the consensus of the community.

Initial Token Distribution

After calling this function, the address `adr` becomes the owner and has been authorized, but the owner before did not give up its authorization.

```solidity=185
function transferOwnership(address payable adr) public onlyOwner {
    owner = adr;
    authorizations[adr] = true;
    emit OwnershipTransferred(adr);
}  
```

Ownership is not completely transferred

The given input is missing the check for the non-zero address.

Missing Input Validation

The contract is serving as the underlying entity to interact with third-party `IDEXRouter` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third party dependencies

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

Redundant Code Components

The linked variables could be declared as `constant` since these state variables are never modified.

Variables That Could Be Declared as `constant`

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

Detects the comparison to boolean constants. Boolean constants can be used directly and do not need to be compared to true or false.


StableGrow

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

13

0

13

0

0