APPLEPYE

Smart Contract Audit Report

Audit Summary

APPLEPYE is a new token with governance and fees on certain buys and sells.

For this audit, we reviewed the project team's APPLEPYE contract at 0x5a83d81daCDcd3f5a5A712823FA4e92275d8ae9F on the Binance Smart Chain Mainnet.

Audit Findings

Please ensure trust in the team prior to investing as they have substantial control in the ecosystem.
Date: April 11th, 2022.
Updated: April 13th, 2022 to reflect changes from address 0xAE30E2D34Cb54Dd18c5EEaF8af26462adea8d4C2 to address 0x5a83d81daCDcd3f5a5A712823FA4e92275d8ae9F.

Finding #1 - APPLEPYE - High (Resolved)

Description: The proper amount of delegates are not moved from the sender when transfer fees are taken.
Risk/Impact: The user or their delegate will retain some of their votes when selling their tokens. If buying from a Pair address in the Pair list, the Pair will also retain votes.
Recommendation: The appropriate moveDelegates() calls should be made when fees are taken.
Resolution: Delegates are now moved to the corresponding fee addresses when fees are taken.

---

Finding #2 - APPLEPYE - Medium (Resolved)

Description: A burn function is avaible to the Burner Role which takes an address and an amount as parameters.
Risk/Impact: The Burner Role can burn any other user's tokens at any time.
Recommendation: The function should be updated to only allow the Burner Role to burn tokens with proper approval.
Resolution: The Burner Role can now only burn users tokens if they have been given an allowance.

---

Finding #3 - APPLEPYE - Informational (Resolved)

Description: The _burnAddress variable is not declared constant, but cannot be updated.
Recommendation: The _burnAddress variable can be declared constant for gas saving purposes.
Resolution: The project team has declared this variable constant.

Contract Overview

• At the time of writing this report, the PYEDeployer contract is granted the Admin Role, Minter Role, Burner Role, and Fee Setter Role.
• As the PYEDeployer contract was not included in the scope of this audit, we are unable to provide an assessment with regards to security or functionality.
• The total supply of the token is currently 0.
• The Minter Role can mint any amount of tokens to any address at any time.
• The Burner Role can burn their own tokens or other users' tokens if they have been given an allowance.
• Each APPLEPYE token additionally represents votes intended to be used in a DAO where one token represents one vote.
• Users may delegate their votes to another address allowing them to vote on behalf of the user.
• Once votes are delegated, the user must explicitly delegate back to themselves to regain their votes.
• Users also have the option to delegate through the use of a signed message, allowing for a gasless delegation for the user.
• When selling to a contract in the Pair list, Non-Excluded users will pay a burn fee.
• When selling to a Pair in the contract's "Outside" Pair list, users will pay a development fee and a burn fee.
• When buying from a Pair in the contract's Outside Pair list, users will pay an increased development fee.
• Excluded users will not pay any sell fees when selling to a contract in the Pair list.
• Development fees will be sent to the development address, and the burn fee will be burned.
• Specified PYESwapPair addresses and the PYESwapRouter address can call the depositLPFee() function at any time, which will transfer a specified token from the caller to this contract and swap it for WBNB.
• As the PYESwapPair and PYESwapRouter contracts were not included in the scope of this audit, we cannot provide an assessment in regards to security or functionality.
• A development fee and buyback fee are taken from the resulting BNB; the development fee is transferred to the development address, and the buyback fee is stored in this contract.
• If buybacks are enabled, they will occur on a transfer if the transfer amount is above a minimum trigger amount, the contract has reached a certain threshold of WBNB, and a certain number of blocks have passed since the last buyback.
• Buybacks will stop occurring if the total buyback amount has exceeded a specified "buyback cap".
• The resulting tokens are sent to the 0x..dead address.
• The project team should ensure that buybacks occur in small amounts to reduce the risk of frontrunning; the team can also monitor buybacks and reduce the threshold if any unusual activity is detected.
• The Admin Role can toggle buybacks or update the buyback threshold, minimum buyback period, minimum trigger amount, and buyback cap at any time.
• The Admin Role can include or exclude an address from sell fees to contracts in the Pair list at any time.
• The Admin Role can update the default Pair and Router addresses at any time.
• The Fee Setter Role can update the buyback fee, development fee, and burn fee at any time.
• The sum of the buyback fee, burn fee, and development fee cannot exceed 25%.
• The Fee Setter Role can update the development address at any time.
• The Admin Role can add or remove a Pair from the Pair list or Outside Pair list at any time.
• The Admin Role can withdraw any BNB or tokens, including APPLEPYE tokens, from the contract at any time.

Audit Results

Inheritance Chart

Function Graph

Functions Overview

 ($) = payable function
 # = non-constant function
 
 + [Int] IBEP20 
    - [Ext] totalSupply
    - [Ext] decimals
    - [Ext] symbol
    - [Ext] name
    - [Ext] getOwner
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Int] IPYESwapRouter01 
    - [Ext] factory
    - [Ext] WETH
    - [Ext] addLiquidity #
    - [Ext] addLiquidityETH ($)
    - [Ext] removeLiquidity #
    - [Ext] removeLiquidityETH #
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)
    - [Ext] quote
    - [Ext] getAmountOut
    - [Ext] getAmountIn
    - [Ext] getAmountsOut
    - [Ext] getAmountsIn

 + [Int] IPYESwapRouter (IPYESwapRouter01)
    - [Ext] removeLiquidityETHSupportingFeeOnTransferTokens #
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #
    - [Ext] pairFeeAddress
    - [Ext] adminFee
    - [Ext] feeAddressGet

 + [Int] IPYESwapPair 
    - [Ext] baseToken
    - [Ext] getTotalFee
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] updateTotalFee #
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #
    - [Ext] MINIMUM_LIQUIDITY
    - [Ext] factory
    - [Ext] token0
    - [Ext] token1
    - [Ext] getReserves
    - [Ext] price0CumulativeLast
    - [Ext] price1CumulativeLast
    - [Ext] kLast
    - [Ext] mint #
    - [Ext] burn #
    - [Ext] swap #
    - [Ext] skim #
    - [Ext] sync #
    - [Ext] initialize #
    - [Ext] setBaseToken #

 + [Int] IPYESwapFactory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] pairExist
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #
    - [Ext] routerInitialize #
    - [Ext] routerAddress

 + [Int] IWETH 
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] deposit ($)
    - [Ext] transfer #
    - [Ext] withdraw #

 + [Int] IERC20 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #

 + [Int] IPYE 
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Int] IERC165 
    - [Ext] supportsInterface

 +  ERC165 (IERC165)
    - [Pub] supportsInterface

 + [Lib] Strings 
    - [Int] toString
    - [Int] toHexString
    - [Int] toHexString

 + [Int] IAccessControl 
    - [Ext] hasRole
    - [Ext] getRoleAdmin
    - [Ext] grantRole #
    - [Ext] revokeRole #
    - [Ext] renounceRole #

 + [Lib] Address 
    - [Int] isContract
    - [Int] sendValue #
    - [Int] functionCall #
    - [Int] functionCall #
    - [Int] functionCallWithValue #
    - [Int] functionCallWithValue #
    - [Int] functionStaticCall
    - [Int] functionStaticCall
    - [Int] functionDelegateCall #
    - [Int] functionDelegateCall #
    - [Int] verifyCallResult

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 +  AccessControl (Context, IAccessControl, ERC165)
    - [Pub] supportsInterface
    - [Pub] hasRole
    - [Int] _checkRole
    - [Pub] getRoleAdmin
    - [Pub] grantRole #
       - modifiers: onlyRole
    - [Pub] revokeRole #
       - modifiers: onlyRole
    - [Pub] renounceRole #
    - [Int] _setupRole #
    - [Int] _setRoleAdmin #
    - [Int] _grantRole #
    - [Int] _revokeRole #

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Int] _transferOwnership #

 + [Lib] SafeMath 
    - [Int] tryAdd
    - [Int] trySub
    - [Int] tryMul
    - [Int] tryDiv
    - [Int] tryMod
    - [Int] add
    - [Int] sub
    - [Int] mul
    - [Int] div
    - [Int] mod
    - [Int] sub
    - [Int] div
    - [Int] mod

 +  BEP20 (Context, IBEP20, Ownable)
    - [Pub]  #
    - [Ext] getOwner
    - [Pub] name
    - [Pub] decimals
    - [Pub] symbol
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Pub] mint #
       - modifiers: onlyOwner
    - [Int] _transfer #
    - [Int] _mint #
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _burnFrom #

 +  APPLEPYE (IPYE, Context, AccessControl)
    - [Pub]  #
    - [Pub] name
    - [Pub] symbol
    - [Pub] decimals
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Pub] excludeFromFee #
    - [Pub] includeInFee #
    - [Pub] addOutsideSwapPair #
    - [Pub] removeOutsideSwapPair #
    - [Int] _updatePairsFee #
    - [Ext] setBuybackPercent #
    - [Ext] setDevelopmentPercent #
    - [Ext] setdevelopmentAddress #
    - [Ext] setSellBurnFee #
    - [Pub] updateRouterAndPair #
    - [Ext]  ($)
    - [Prv] _getValues
    - [Prv] calculateFee
    - [Prv] removeAllFee #
    - [Prv] setSellFee #
    - [Prv] setOutsideBuyFee #
    - [Prv] setOutsideSellFee #
    - [Prv] restoreAllFee #
    - [Pub] isExcludedFromFee
    - [Prv] _approve #
    - [Pub] getBalance
    - [Prv] _transfer #
    - [Pub] getCirculatingSupply
    - [Pub] getTotalFee
    - [Prv] _tokenTransfer #
    - [Prv] _takeFees #
    - [Prv] _takeFee #
    - [Prv] _takeBurnFee #
    - [Pub] depositLPFee #
       - modifiers: onlyExchange
    - [Int] swapToWBNB #
    - [Int] shouldAutoBuyback
    - [Int] triggerAutoBuyback #
    - [Int] buyTokens #
       - modifiers: swapping
    - [Ext] setAutoBuybackSettings #
    - [Int] _getTokenIndex
    - [Pub] addPair #
    - [Int] _checkPairRegistered
    - [Ext] rescueBNB #
    - [Ext] rescueToken #
    - [Int] _mint #
    - [Int] _burn #
    - [Pub] mint #
    - [Pub] burn #
    - [Ext] delegate #
    - [Ext] delegateBySig #
    - [Ext] getCurrentVotes
    - [Ext] getPriorVotes
    - [Int] _delegate #
    - [Int] _moveDelegates #
    - [Int] _writeCheckpoint #
    - [Int] safe32
    - [Int] getChainId

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home