Read the findings of the 2022 Web3 Security Report

The `WorldCupToken` contract is a decentralized finance(DeFi) token deployed on the BSC.\
Each `WorldCupToken` transaction is taxed with fees totaling `MarketingFee` plus `DevelopmentFee` plus `LiquidityFee` of the transaction amount during sell/buy transaction,which will be transferred to the contract.

The tokens owned by the contract are redistributed in the following manner in each transaction as below : 
* 95%(19/20) of `$WCT` tokens will be swapped for BNB which will be split between:
  * for liquidity(1/19)
  * DevelopmentWallet(4/19)
  * the remaining(14/19) for MarketingWallet
* The remaining (1/20) `$WCT` tokens will be used to add liquidity.

And the owner can change these rates.

Financial Models

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.
![](https://accelerator-tasks-prod.s3.amazonaws.com/b2ac54b9cbe34b67b7dbee8095661ab5/diagrams/centralization_Ownable__owner.svg)

In the contract `WorldCupToken` the role `_owner` has authority over the functions shown in the diagram below.
![](https://accelerator-tasks-prod.s3.amazonaws.com/b2ac54b9cbe34b67b7dbee8095661ab5/diagrams/centralization_WorldCupToken__owner.svg)

Any compromise to the privileged account may allow the hacker to take advantage of this authority and modify the contract configuration.

Centralization Risks in WorldCupToken.sol

All of the `$WCT` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

```solidity=
    // add the liquidity
    uniswapV2Router.addLiquidityETH{value: ethAmount}(
        address(this),
        tokenAmount,
        0, // slippage is unavoidable
        0, // slippage is unavoidable
        owner(),
        block.timestamp
    );
```

The `addLiquidity()` function calls the `uniswapV2Router.addLiquidityETH` function with the `to` address specified as `owner()` for acquiring the generated LP tokens from the `$WCT-WBNB` pool. As a result, over time the `_owner` address will accumulate a significant portion of LP tokens.If the `_owner` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences to the project as a whole.

Centralized Risk in `addLiquidity`

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

File: WorldCupToken.sol (Line 581, Function `WorldCupToken.setMarketingWalletAddress`)
```solidity
    marketingWalletAddress = payable(newAddress);
```
- `newAddress` is not zero-checked before being used.


---
File: WorldCupToken.sol (Line 585, Function `WorldCupToken.setDevelopmentWalletAddress`)
```solidity
    DevelopmentWalletAddress = payable(newAddress);
```
- `newAddress` is not zero-checked before being used.



Missing Zero Address Validation

The owner can set fees without limitations. If these fees are set to 100%, the user might get nothing in the exchange.

No Upper Limit for`fees`  

State variables that never change should be declared as `constant` to save gas.

File: WorldCupToken.sol (Line 379, Contract `WorldCupToken`)
```solidity
    string private _name = "World Cup Token";
```
- `_name` should be declared `constant`.


---
File: WorldCupToken.sol (Line 380, Contract `WorldCupToken`)
```solidity
    string private _symbol = "$WCT";
```
- `_symbol` should be declared `constant`.


---
File: WorldCupToken.sol (Line 381, Contract `WorldCupToken`)
```solidity
    uint8 private _decimals = 9;
```
- `_decimals` should be declared `constant`.


---
File: WorldCupToken.sol (Line 410, Contract `WorldCupToken`)
```solidity
    uint256 private _totalSupply = 1000 * 10**6 * 10**9;
```
- `_totalSupply` should be declared `constant`.



State Variable Should Be Declared Constant

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Missing Emit Events

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Missing Error Messages

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

World Cup Token

WorldCupToken.sol

World Cup Token

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

10

0

10

0

0