Read the findings of the 2022 Web3 Security Report

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- `swapExactTokensForTokens()`
- `addLiquidity()`

Potential Sandwich Attacks

The function `_addPayee` is `internal`, which is called by `addNewPayee` and `initialize`. There is no need to add `onlyOwner` for `internal` function.

Redundant Modifier "onlyOwner"

The function `_release` is `internal`, which is called by the function `release_all` in a loop, so `nonReentrant` runs repeatedly.

Repeated Checking `nonReentrant`

In the function `_release`, it uses `require` statement to ensure `payment != 0` or it reverts the `release_all` function even though the `payment` is not zero for other accounts.

If One Account `payment`==0, All Accounts Can't Get `payment`

In the contract, `Distribution`, the role, `_owner`, has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/eb6ea0a08dba4372934d8b70c1a4d98a/Distribution-_owner.svg)

Centralization Risk in Distribution.sol

Contracts `TipsyBuyBack`, `Distribution`, `TokenTimelock`, `TipsyCoin`, `BasicTokenContract` and `TokenVesting` are upgradeable contract, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.


Centralized Control of Contract Upgrade

There are some testing code blocks in the audit contracts. Because the file hash is in the audit report, it's better to remove all unnecessary code from contract.

Remove Testing Code

According to the comments, the trade tax is 10% of trade amount. `_feeTotal` equals `buybackFundAmount + marketingCommunityAmount + reflexiveAmount`, so `amount * buybackFundAmount / _feeTotal + amount * marketingCommunityAmount / _feeTotal +amount * reflexiveAmount / _feeTotal` is 100%, not 10%.

Incorrect Calculation Of Tax

In the function `transferFrom`, `currentAllowance` is `realAmount`, but `amount` is `reflexAmount`, comparing these two types of value is incorrect.

Miss Comparing `realAmount` and `reflexAmount`

In the function `transferFrom`, there is no `transfer` event emitted.

Missing Emit `transfer` Event

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- `pancakeV2Router.swapExactTokensForTokens()`

In the contract, `TipsyCoin`, the role, `_owner`, has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/eb6ea0a08dba4372934d8b70c1a4d98a/TipsyCoin-_owner.svg)

Centralization Risk in TipsyCoin.sol

In the contract, `TokenVesting`, the role, `_owner`, has authority over the functions shown in the diagram below.

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.

![](https://accelerator-tasks-prod.s3.amazonaws.com/eb6ea0a08dba4372934d8b70c1a4d98a/TokenVesting-_owner.svg)

Centralization Risk in TokenVesting.sol

Tipsy Coin

ITokenTimelock.sol

Imports.sol

TimeLock.sol

TipsyCoin

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

13

0

1

2

10