Ginga Finance
Search…
⌃K

Findings

Issue 01

Type
Severity
Location
Status
Best Practice
Informational
All
Acknowledged
Description
10 ** 18 is a standard unit in solidity, and has a special keyword "ether".
Recommendation
Consider using ether instead of 10**18 for readability.

Issue 02

Type
Severity
Location
Status
Best Practice
Medium
receive
✔️Resolved
Description
There is a receive function in the contract, which means any address can send BNB to the contract. The problem is that there is no way to recover BNB that were mistakenly sent to the contract.
Recommendation
In order to prevent the contract from receiving BNB from investors, which will result in a loss of funds, our recommendation is to only accept ETH from “whitelisted” addresses (e.g. the router address). The receive function will revert if the address is not whitelisted.

Issue 03

Type
Severity
Location
Status
Best Practice
Informational
Multiple locations
Acknowledged
Description
The set functions don't emit events.
Recommendation
Consider adding events when changing critical variables or the state of the contract.

Issue 04

Type
Severity
Location
Status
Owner Capabilities
Informational
blacklistAddress
✔️Resolved
Description
The owner of the contract can blacklist any address, at any time.
Recommendation
Our recommendation is to limit the timeframe when the owner can append an address to the blacklist.

Issue 05

Type
Severity
Location
Status
Gas Optimization
Informational
isExcludedFromFees
Acknowledged
Description
isExcludedFromFees could have been declared as external to save on gas fees.

Issue 06

Type
Severity
Location
Volatile Code
High
_transfer
✔️Resolved
Description
_transfer may call internally to swapExactTokensForETHSupportingFeeOnTransferTokens and addLiquidityETH , which may cause _transfer to fail unnecessarily.
Recommendation
_transfer should always work, and shouldn't fail if swapExactTokensForETHSupportingFeeOnTransferTokens or addLiquidityETH fails to ensure token will always be tradable.

Issue 07

Type
Severity
Location
Status
Gas Optimization
Informational
_transfer
Acknowledged
Description
The code doesn’t differentiate between sell transaction and addLiquidity transaction (because the user sends tokens to the pair) and buy transaction and removeLiquidity transaction (because the user receives tokens from the pair). Therefore, the custom tax will be applied to liquidity removal as well as liquidity addition.

Issue 08

Type
Severity
Location
Status
Gas Optimization
Informational
_approve
Acknowledged
Approve is being called every transaction on the same tokens and for the same spender (the router).
Recommendation
In order to reduce gas costs, approve could be called once (with max int), and then check if it is needed again using allowance.

Issue 09

Type
Severity
Location
Status
Logical Issue
Informational
swapAndSendDividends
Acknowledged
Description
If the dividends token has fees on transfer, the code may not work as intended since the dividends contract will receive fewer tokens than expected and the rewards won't be calculated correctly.
Recommendation
Consider adding general support for dividends tokens with fees on transfer.
Since busd address can't be changed, the issue is marked as informational.

Issue 10

Type
Severity
Location
Status
Logical Issue
Medium
swapAndSendDividends
✔️Resolved
Description
_transfer may call swapAndSendDividends internally. This function can be called during _transfer and potentially failing when totalSupply of DividendPayingToken is 0.
Recommendation
Consider using try-catch when calling distributeTokenDividends

Issue 11

Type
Severity
Location
Status
Logical Issue
Low
swapAndSendDividends
Acknowledged
Description
swapAndSendDividends will fail if totalSupply of DividendPayingToken is 0.
Recommendation
Consider handling a scenario in which totalSupply is 0, and dividends are transferred to the contract.

Issue 12

Type
Severity
Location
Status
Owner Capabilities
High
blacklistAddress
✔️Resolved
Description
The owner can blacklist any address. If the owner blacklists the pair address or the contract address the token will be untradeable.
Recommendation
Add a require statement that prohibits the owner from blacklisting the pair address and the contract address.

Issue 13

Type
Severity
Location
Status
Owner Capabilities
High
updateUniswapV2Router
✔️Resolved
Description The owner can set PancakeSwap's router address, which gives him full control over all token swaps.
Recommendation
Consider implementing a timelock mechanism to allow users to review the changes, or remove this feature altogether as backward-incompatible router updates are a very rare event.

Issue 14

Type
Severity
Location
Status
Owner Capabilities
High
setBUSDRewardsFee
✔️Resolved
Description
The owner of the contract can set the busd rewards fee, marketing fee, and liquidity fee by calling set setBUSDRewardsFee or setLiquiditFee or setMarketingFee to any value they desire. If the owner sets the fee to 100% the token will be untradeable.
Recommendation
Consider adding an upper limit for the set functions.

Issue 15

Type
Severity
Location
Status
Gas Optimization
Informational
setBUSDRewardsFee
Acknowledged
Description
The contract may call swapExactTokensForETHSupportingFeeOnTransferTokens 3 times, each call consumes a large amount of gas.
Recommendation
Consider calling this function only once.