In the contract `VICToken` the role `_owner` has authority over the functions shown in the diagram below.
Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.
![](https://accelerator-tasks-prod.s3.amazonaws.com/a2d0a347c597427aae3d1f73a189b3c2/diagrams/centralization_VICToken__owner.svg)

Centralization Risks in VICToken.sol

The project has a privileged function allowing roles like `owner` to drain funds directly from the contract by setting `tokenaddress` as `address(this)`. 

```solidity=
  function sentT2Pool2token(address tokenaddress) external onlyOwner {
    uint256 newBalance = IBEP20(tokenaddress).balanceOf(address(this));
    if(newBalance>0){
      IBEP20(tokenaddress).transfer(Pool2, newBalance);
    }
  }
```


Centralization risk in function `sentT2Pool2token()`

All of the VIC tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute VIC tokens without obtaining the consensus of the community.

Initial Token Distribution

In the `contract VICToken.sol`, state variables
  - `marketingPool` is initialized as `0xf062268048A726ba01E0D7B368BB5FD013eED7bf`
  - `Treasury` is initialized as `0xbCAcBf064a989DDA384fEC060D22B0852828d9C8`
  - `VicGemPool` is initialized as `0xd5fc1b54DC5F54355588FdA49f696acb891c0375`
  - `Pool2` is initialized as `0xfBAce007a4e4681E906aBe1dd3b1a0A645f5C797`
the ownership of aforementioned accounts are uncertain and they can be changed later by `_owner`.

Unknown externally owned account(EOA)

The contract is serving as the underlying entity to interact with third party PancakeSwap protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The return value of the transfer()/transferFrom() call is not checked.

File: VICToken.sol (Line 158, Function `VICToken.sentT2Pool2token`)
```solidity
      IBEP20(tokenaddress).transfer(Pool2, newBalance);
```



Unchecked ERC-20 `transfer()`/`transferFrom()` Call

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

File: VICToken.sol (Line 102, Function `VICToken.setVicGemPool`)
```solidity
    VicGemPool = _VicGemPool;
```
- `_VicGemPool` is not zero-checked before being used.


---
File: VICToken.sol (Line 87, Function `VICToken.setMarketingPool`)
```solidity
    marketingPool = _marketingPool;
```
- `_marketingPool` is not zero-checked before being used.


---
File: VICToken.sol (Line 92, Function `VICToken.setPool2`)
```solidity
    Pool2 = _Pool2;
```
- `_Pool2` is not zero-checked before being used.


---
File: VICToken.sol (Line 97, Function `VICToken.setTreasury`)
```solidity
    Treasury = _Treasury;
```
- `_Treasury` is not zero-checked before being used.



Missing Zero Address Validation

Performing integer division before multiplication truncates the low bits, losing the precision of calculation.

File: VICToken.sol (Line 200, Function `VICToken._transfer`)
```solidity
        uint256 mktTax = taxAmount.div(100).mul(mktTaxPercent);
```


---
File: VICToken.sol (Line 201, Function `VICToken._transfer`)
```solidity
        uint256 TreasuryTax = taxAmount.div(100).mul(TreasuryTaxPercent);
```


---
File: VICToken.sol (Line 202, Function `VICToken._transfer`)
```solidity
        uint256 VicGemPoolTax = taxAmount.div(100).mul(VicGemPoolTaxPercent);
```



Divide Before Multiply

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

If `onlyOwner` sets enableTax as true, the input amount for `transfer()` may not be equal to the received amount due to the charged (and burned) transaction fee. As a result, this may not meet the assumption behind these low-level asset-transferring routines and will decrease the total supply of the VICSTEP contract.

VICSTEP

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

10

0

0