> For the complete documentation index, see [llms.txt](https://audits.solidgrp.io/ginga-finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://audits.solidgrp.io/ginga-finance/audit-result/findings.md).

# Findings

### Issue 01 

<table data-header-hidden><thead><tr><th width="245.66666666666666">Type</th><th width="228.29117191533302">Severity</th><th width="178">Location</th><th>Status</th></tr></thead><tbody><tr><td>Type</td><td>Severity</td><td>Location</td><td>Status</td></tr><tr><td>Best Practice</td><td><mark style="color:green;"><strong>Informational</strong></mark></td><td>All</td><td><mark style="color:yellow;"><strong>Acknowledged</strong></mark></td></tr></tbody></table>

**Description**

10 \*\* 18 is a standard unit in solidity, and has a special keyword "ether".

**Recommendation**&#x20;

Consider using ether instead of 10\*\*18 for readability.&#x20;

### **Issue 02**

| **Type**      | **Severity**                                  | **Location** | **Status**                                       |
| ------------- | --------------------------------------------- | ------------ | ------------------------------------------------ |
| Best Practice | <mark style="color:orange;">**Medium**</mark> | `receive`    | <mark style="color:green;">**✔️Resolved**</mark> |

**Description**

There is a receive function in the contract, which means any address can send BNB to the contract. The problem is that there is no way to recover BNB that were mistakenly sent to the contract.

**Recommendation**

In order to prevent the contract from receiving BNB from investors, which will result in a loss of funds, our recommendation is to only accept ETH from “whitelisted” addresses  (e.g. the router address).\
The receive function will revert if the address is not whitelisted.

### Issue 03

| Type          | **Severity**                                        | **Location**       | **Status**                                          |
| ------------- | --------------------------------------------------- | ------------------ | --------------------------------------------------- |
| Best Practice | <mark style="color:green;">**Informational**</mark> | Multiple locations | <mark style="color:yellow;">**Acknowledged**</mark> |

**Description**

The set functions don't emit events.

**Recommendation**

Consider adding events when changing critical variables or the state of the contract.

### Issue 04

| **Type**           | **Severity**                                        | **Location**       | **Status**                                       |
| ------------------ | --------------------------------------------------- | ------------------ | ------------------------------------------------ |
| Owner Capabilities | <mark style="color:green;">**Informational**</mark> | `blacklistAddress` | <mark style="color:green;">**✔️Resolved**</mark> |

**Description**

The owner of the contract can blacklist any address, at any time.&#x20;

**Recommendation**

Our recommendation is to limit the timeframe when the owner can append an address to the blacklist.

### Issue 05

| Type             | **Severity**                                        | **Location**         | **Status**                                          |
| ---------------- | --------------------------------------------------- | -------------------- | --------------------------------------------------- |
| Gas Optimization | <mark style="color:green;">**Informational**</mark> | `isExcludedFromFees` | <mark style="color:yellow;">**Acknowledged**</mark> |

**Description**

`isExcludedFromFees` could have been declared as external to save on gas fees. &#x20;

### **Issue 06**

| **Type**      | **Severity**                             | **Location** |                                                  |
| ------------- | ---------------------------------------- | ------------ | ------------------------------------------------ |
| Volatile Code | <mark style="color:red;">**High**</mark> | `_transfer`  | ✔️<mark style="color:green;">**Resolved**</mark> |

**Description**

`_transfer` may call internally to `swapExactTokensForETHSupportingFeeOnTransferTokens` and `addLiquidityETH` , which may cause `_transfer` to fail unnecessarily.

**Recommendation**

`_transfer` should always work, and shouldn't fail if  `swapExactTokensForETHSupportingFeeOnTransferTokens` or `addLiquidityETH` fails to ensure **token will always be tradable.**

### **Issue 07**

| Type             | Severity                                            | Location    | Status                                              |
| ---------------- | --------------------------------------------------- | ----------- | --------------------------------------------------- |
| Gas Optimization | <mark style="color:green;">**Informational**</mark> | `_transfer` | <mark style="color:yellow;">**Acknowledged**</mark> |

**Description**

The code doesn’t **differentiate** between **sell transaction and addLiquidity transaction** (because the user sends tokens to the pair) and **buy transaction and removeLiquidity** **transaction** (because the user receives tokens from the pair). Therefore, the custom tax will be applied to liquidity removal as well as liquidity addition.

### **Issue 08**

<table data-header-hidden><thead><tr><th>Type</th><th>Severity </th><th width="200">Location</th><th>Status</th></tr></thead><tbody><tr><td>Type</td><td>Severity </td><td>Location</td><td>Status</td></tr><tr><td>Gas Optimization</td><td><mark style="color:green;"><strong>Informational</strong></mark></td><td><code>_approve</code></td><td><mark style="color:yellow;"><strong>Acknowledged</strong></mark></td></tr></tbody></table>

Approve is being called every transaction on the same tokens and for the same spender (the router). &#x20;

**Recommendation**

In order to reduce gas costs, `approve` could be called once (with max int), and then check if it is needed again using `allowance`.

### **Issue 09**

| Type          | Severity                                            | Location               | Status                                                                         |
| ------------- | --------------------------------------------------- | ---------------------- | ------------------------------------------------------------------------------ |
| Logical Issue | <mark style="color:green;">**Informational**</mark> | `swapAndSendDividends` | <p></p><p><mark style="color:yellow;"><strong>Acknowledged</strong></mark></p> |

**Description**

If the dividends token has fees on transfer, the code may not work as intended since the dividends contract will receive fewer tokens than expected and the rewards won't be calculated correctly. &#x20;

**Recommendation**

Consider adding general support for dividends tokens with fees on transfer.&#x20;

Since busd address can't be changed, the issue is marked as informational.&#x20;

### **Issue 10**

| Type          | Severity                                      | Location               | Status                                           |
| ------------- | --------------------------------------------- | ---------------------- | ------------------------------------------------ |
| Logical Issue | <mark style="color:orange;">**Medium**</mark> | `swapAndSendDividends` | <mark style="color:green;">**✔️Resolved**</mark> |

**Description**

`_transfer` may call `swapAndSendDividends` internally. This function can be called during `_transfer` and potentially failing when `totalSupply` of DividendPayingToken is 0.&#x20;

**Recommendation**

Consider using try-catch when calling `distributeTokenDividends`

### **Issue 11**

| `Type`        | Severity                                   | Location               | Status                                              |
| ------------- | ------------------------------------------ | ---------------------- | --------------------------------------------------- |
| Logical Issue | <mark style="color:yellow;">**Low**</mark> | `swapAndSendDividends` | <mark style="color:yellow;">**Acknowledged**</mark> |

**Description**

`swapAndSendDividends` will fail if totalSupply of DividendPayingToken is 0.

**Recommendation**

Consider handling a scenario in which totalSupply is 0, and dividends are transferred to the contract.&#x20;

### **Issue 12**

| Type               | Severity                                 | Location           | Status                                           |
| ------------------ | ---------------------------------------- | ------------------ | ------------------------------------------------ |
| Owner Capabilities | <mark style="color:red;">**High**</mark> | `blacklistAddress` | ✔️<mark style="color:green;">**Resolved**</mark> |

**Description**

The owner can blacklist any address. If the owner blacklists the pair address or the contract address the token will be untradeable.

**Recommendation**

Add a require statement that prohibits the owner from blacklisting the pair address and the contract address.&#x20;

## Issue 13

| Type               | Severity                                 | Location              | Status                                               |
| ------------------ | ---------------------------------------- | --------------------- | ---------------------------------------------------- |
| Owner Capabilities | <mark style="color:red;">**High**</mark> | updateUniswapV2Router | **✔️**<mark style="color:green;">**Resolved**</mark> |

**Description**\
The owner can set PancakeSwap's router address, which gives him full control over all token swaps.&#x20;

**Recommendation**

Consider implementing a timelock mechanism to allow users to review the changes, or remove this feature altogether as backward-incompatible router updates are a very rare event.

## Issue 14

| Type               | Severity                                 | Location          | Status                                               |
| ------------------ | ---------------------------------------- | ----------------- | ---------------------------------------------------- |
| Owner Capabilities | <mark style="color:red;">**High**</mark> | setBUSDRewardsFee | **✔️**<mark style="color:green;">**Resolved**</mark> |

**Description**

The owner of the contract can set the busd rewards fee, marketing fee, and liquidity fee by calling set setBUSDRewardsFee or setLiquiditFee or setMarketingFee to any value they desire. If the owner sets the fee to 100% the token will be untradeable.

**Recommendation**

Consider adding an upper limit for the set functions.

## Issue 15

| Type             | Severity                                            | Location          | Status                                              |
| ---------------- | --------------------------------------------------- | ----------------- | --------------------------------------------------- |
| Gas Optimization | <mark style="color:green;">**Informational**</mark> | setBUSDRewardsFee | <mark style="color:yellow;">**Acknowledged**</mark> |

**Description**

The contract may call `swapExactTokensForETHSupportingFeeOnTransferTokens` 3 times, each call consumes a large amount of gas.&#x20;

**Recommendation**

Consider calling this function only once.