-
BESCScan

Security Audit Report

</> API

PumpCopyTradeExecutor0x9499e512Fe…c0E8c798

source verifiedslither
55out of 100
poor

6 blocking issues

At least one finding describes a plausible path to loss of funds or control. Read those findings before interacting with this contract.

Findings
6
Engines
slither
Scanned
Source
Published

Findings by severity

Critical

0

High

6

Medium

0

Low

0

Informational

0

Gas

0

Findings (6)

high

2 checks · 6 instances

A plausible path to loss of funds or control. Treat as blocking.

  • Instance 1 of 2

    PumpCopyTradeExecutor.executeCopyBuy(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#177-220) uses arbitrary from in transferFrom: money.safeTransferFrom(copier,address(this),totalPull) (contracts/PumpCopyTradeExecutor.sol#197)

    Instance 2 of 2

    PumpCopyTradeExecutor.executeCopySell(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#234-270) uses arbitrary from in transferFrom: IERC20(token).safeTransferFrom(copier,address(this),tokensIn) (contracts/PumpCopyTradeExecutor.sol#245)

  • Instance 1 of 4

    Reentrancy in PumpCopyTradeExecutor.executeCopySell(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#234-270):
	External call allowing reentrancy:
	- money.safeTransfer(relayer,fee) (contracts/PumpCopyTradeExecutor.sol#259)
	Balance read before the call:
	- moneyBefore = money.balanceOf(address(this)) (contracts/PumpCopyTradeExecutor.sol#251)
	Possible stale balance used after the call in a condition:
	- require(bool,string)(netMoneyOut > 0,zero money out after fee) (contracts/PumpCopyTradeExecutor.sol#262)
		- stale variable `netMoneyOut`

    Instance 2 of 4

    Reentrancy in PumpCopyTradeExecutor.executeCopySell(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#234-270):
	External call allowing reentrancy:
	- money.safeTransfer(relayer,fee) (contracts/PumpCopyTradeExecutor.sol#259)
	Balance read before the call:
	- grossMoneyOut = money.balanceOf(address(this)) - moneyBefore (contracts/PumpCopyTradeExecutor.sol#253)
	Possible stale balance used after the call in a condition:
	- require(bool,string)(netMoneyOut > 0,zero money out after fee) (contracts/PumpCopyTradeExecutor.sol#262)
		- stale variable `netMoneyOut`

    Instance 3 of 4

    Reentrancy in PumpCopyTradeExecutor.executeCopyBuy(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#177-220):
	External call allowing reentrancy:
	- pump.buy(token,moneyIn,minOut,address(0)) (contracts/PumpCopyTradeExecutor.sol#208)
	Balance read before the call:
	- tokensBefore = IERC20(token).balanceOf(address(this)) (contracts/PumpCopyTradeExecutor.sol#207)
	Possible stale balance used after the call in a condition:
	- require(bool,string)(tokensOut > 0,zero tokens out) (contracts/PumpCopyTradeExecutor.sol#212)
		- stale variable `tokensOut`

    Instance 4 of 4

    Reentrancy in PumpCopyTradeExecutor.executeCopySell(address,address,address,uint256,uint256) (contracts/PumpCopyTradeExecutor.sol#234-270):
	External call allowing reentrancy:
	- pump.sell(token,tokensIn,minOut) (contracts/PumpCopyTradeExecutor.sol#252)
	Balance read before the call:
	- moneyBefore = money.balanceOf(address(this)) (contracts/PumpCopyTradeExecutor.sol#251)
	Possible stale balance used after the call in a condition:
	- require(bool,string)(netMoneyOut > 0,zero money out after fee) (contracts/PumpCopyTradeExecutor.sol#262)
		- stale variable `netMoneyOut`

Scope and limitations

This is automated static analysis, run by slither against this contract’s published source. It is not a manual audit and nobody has reviewed these results by hand.

  • It finds known patterns. A novel bug, or one that depends on how this contract is used alongside another, is exactly what it does not find.
  • It cannot judge intent. A contract that lets its owner mint without limit is working as written; whether that is acceptable is not a question a scanner answers.
  • It says nothing about the people behind the contract, the liquidity, or whether the deployer still holds the keys.
  • A high score means the analysers had few complaints. It is not a guarantee, an endorsement, or advice to interact.

Read the source yourself where it matters. This contract’s source is published.