Surge - Smart Contract Audit Report

Summary

Surge is a new token with frictionless fee redistribution, liquidity adds, and a buyback system for burning supply.

We audited the Surge team's Reflective, Token, and Outpost contracts using code provided to us by the project team.

Overview of the Contract:
The total supply of the token is set to one trillion.
No mint or burn functions are present; though the circulating supply can be reduced by sending tokens to the 0x..dead address, if desired.
Initially, 100% of the total supply will be held by the owner.

There is a 1% tax fee and a 13% swap fee on all transactions.
Users who hold tokens will automatically benefit from the frictionless fee redistribution at the time of each transaction as the tokens collected through the tax fee are removed from the circulating supply.
The tokens collected through the swap fee are stored in the contract and, once a threshold value of 550 million SURGE tokens is met, a portion of the tokens are sold for ETH and 2% is sent to the project team's reserve wallet.
Liquidity-adds are funded by selling half of the remaining tokens, pairing the received ETH with the token, and adding it as liquidity to the ETH pair.
The newly created LP tokens are stored in the contract address and are locked for 1 year after the contract's initialization.
A portion of any remaining ETH will be swapped for tokens and sent to a wallet address controlled by the project team, given that the minimum ETH balance for this action has been met.

Any user with a balance of 500 million token may be able to call the upsurge function; there is a cooldown period in between calls to the upsurge function.
Users can use the upsurge function to remove a portion of the ETH from the liquidity pool and place it in the Outpost contract.
The upsurge function will transfer 4% of the ETH in the Outpost contract balance to the reserve wallet address controlled by the team.
The remaining ETH will be swapped for SURGE tokens; 0.25% of the tokens are delivered to the user as a reward, and the remaining tokens are burned.

The owner of the contract can grant any wallet address or contract address Admin rights, which allows users to set various variables in the ecosystem.
Any authorized admin can include and exclude users from the blacklist, rewards, and fees, set the tax fee and the reserve fee percentages to any value up to 10%, set the swap fee to any value up to 20%, set the minimum threshold in order to trigger a swap and liquify, set the cooldown time, and set the max transaction amount to any value at any time.
Any authorized admin can set the minimum balance requirement to trigger an upsurge and the percentage of the LP balance taken during the upsurge to any value up to 10%.
The owner or any authorized admin must call the unlockHP function within 300 seconds of deployment; otherwise, the upsurge functionality will be defunct.
Any authorized admin can set the Outpost contract address to any address at any time.
Any authorized admin can toggle the max transaction requirement, the swap and liquify functionality, and the booster functionality at any time.

The team has worked with us to optimize these contracts for gas efficiency.
The contract utilizes SafeMath library to prevent overflows along with following the ERC20 standard.

Audit Findings Summary
Buyback functionality may be suseptible to front-running; The team must monitor and if suspicious activity is detected, the team must disable the buyback system.
Ensure trust in the team as they have substantial control in the ecosystem.
Date: July 24th, 2021

Vulnerability Category	Notes	Result
Arbitrary Storage Write	N/A	PASS
Arbitrary Jump	N/A	PASS
Delegate Call to Untrusted Contract	N/A	PASS
Dependence on Predictable Variables	N/A	PASS
Deprecated Opcodes	N/A	PASS
Ether Thief	N/A	PASS
Exceptions	N/A	PASS
External Calls	N/A	PASS
Flash Loans	N/A	PASS
Integer Over/Underflow	N/A	PASS
Multiple Sends	N/A	PASS
Oracles	N/A	PASS
Suicide	N/A	PASS
State Change External Calls	N/A	PASS
Unchecked Retval	N/A	PASS
User Supplied Assertion	N/A	PASS
Critical Solidity Compiler	N/A	PASS
Overall Contract Safety		PASS

BEP20 Token Graph

Multi-file Token

												
($) = payable function
 # = non-constant function

 + [Int] IERC20 
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Int] IUniswapV2Factory 
    - [Ext] feeTo
    - [Ext] feeToSetter
    - [Ext] getPair
    - [Ext] allPairs
    - [Ext] allPairsLength
    - [Ext] createPair #
    - [Ext] setFeeTo #
    - [Ext] setFeeToSetter #

 + [Int] IUniswapV2Pair 
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transfer #
    - [Ext] transferFrom #
    - [Ext] DOMAIN_SEPARATOR
    - [Ext] PERMIT_TYPEHASH
    - [Ext] nonces
    - [Ext] permit #
    - [Ext] MINIMUM_LIQUIDITY
    - [Ext] factory
    - [Ext] token0
    - [Ext] token1
    - [Ext] getReserves
    - [Ext] price0CumulativeLast
    - [Ext] price1CumulativeLast
    - [Ext] kLast
    - [Ext] mint #
    - [Ext] burn #
    - [Ext] swap #
    - [Ext] skim #
    - [Ext] sync #
    - [Ext] initialize #

 + [Int] IUniswapV2Router01 
    - [Ext] factory
    - [Ext] WETH
    - [Ext] addLiquidity #
    - [Ext] addLiquidityETH ($)
    - [Ext] removeLiquidity #
    - [Ext] removeLiquidityETH #
    - [Ext] removeLiquidityWithPermit #
    - [Ext] removeLiquidityETHWithPermit #
    - [Ext] swapExactTokensForTokens #
    - [Ext] swapTokensForExactTokens #
    - [Ext] swapExactETHForTokens ($)
    - [Ext] swapTokensForExactETH #
    - [Ext] swapExactTokensForETH #
    - [Ext] swapETHForExactTokens ($)
    - [Ext] quote
    - [Ext] getAmountOut
    - [Ext] getAmountIn
    - [Ext] getAmountsOut
    - [Ext] getAmountsIn

 + [Int] IUniswapV2Router02 (IUniswapV2Router01)
    - [Ext] removeLiquidityETHSupportingFeeOnTransferTokens #
    - [Ext] removeLiquidityETHWithPermitSupportingFeeOnTransferTokens #
    - [Ext] swapExactTokensForTokensSupportingFeeOnTransferTokens #
    - [Ext] swapExactETHForTokensSupportingFeeOnTransferTokens ($)
    - [Ext] swapExactTokensForETHSupportingFeeOnTransferTokens #

 + [Lib] Address 
    - [Int] isContract
    - [Int] sendValue #
    - [Int] functionCall #
    - [Int] functionCall #
    - [Int] functionCallWithValue #
    - [Int] functionCallWithValue #
    - [Prv] _functionCallWithValue #

 + [Lib] SafeMath 
    - [Int] add
    - [Int] sub
    - [Int] sub
    - [Int] mul
    - [Int] div
    - [Int] div
    - [Int] mod
    - [Int] mod

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner

 +  Authorizable (Ownable)
    - [Pub] addAuthorized #
       - modifiers: onlyOwner
    - [Pub] removeAuthorized #
       - modifiers: onlyOwner

 +  Reflective (IERC20, Authorizable)
    - [Pub]  #
    - [Ext] excludeBlacklist #
       - modifiers: onlyAuthorized
    - [Ext] includeBlacklist #
       - modifiers: onlyAuthorized
    - [Ext] setTaxFeePercent #
       - modifiers: onlyAuthorized
    - [Ext] setSwapFeePercent #
       - modifiers: onlyAuthorized
    - [Ext] setReserveFeePercent #
       - modifiers: onlyAuthorized
    - [Ext] setStar #
       - modifiers: onlyAuthorized
    - [Ext] setMaxTx #
       - modifiers: onlyAuthorized
    - [Ext] setMaxTxEnabled #
       - modifiers: onlyAuthorized
    - [Ext] setSwapAndLiquifyEnabled #
       - modifiers: onlyAuthorized
    - [Ext] setSwapAndBoostereEnabled #
       - modifiers: onlyAuthorized
    - [Ext] setMinimumAccumulationForBooster #
       - modifiers: onlyAuthorized
    - [Ext] setMinimumAccumulationForLiquidity #
       - modifiers: onlyAuthorized
    - [Ext] setBoosterCeiling #
       - modifiers: onlyAuthorized
    - [Ext] setBoosterFloor #
       - modifiers: onlyAuthorized
    - [Ext] setBoosterRequisite #
       - modifiers: onlyAuthorized
    - [Ext] setBoosterDivisor #
       - modifiers: onlyAuthorized
    - [Ext] excludeFromReward #
       - modifiers: onlyAuthorized
    - [Ext] includeInReward #
       - modifiers: onlyAuthorized
    - [Ext] getTaxFee
    - [Ext] getReserveFee
    - [Ext] getSwapFees
    - [Ext] getMaxTx
    - [Ext] getBoosterSizeValue
    - [Ext] getBoosterSizePercent
    - [Ext] getBoosterFloor
    - [Ext] getBoosterCeiling
    - [Ext] getBoosterDivisor
    - [Ext] getBoosterRequisite
    - [Ext] getBoosterReserve
    - [Ext] isLiquificationEnabled
    - [Ext] isBoosterEnabled
    - [Ext] isMaxTxEnabled
    - [Ext] isBlacklisted
    - [Ext] excludeFromFee #
       - modifiers: onlyAuthorized
    - [Ext] includeInFee #
       - modifiers: onlyAuthorized
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals
    - [Ext] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Ext] transferFrom #
    - [Ext] transferBatch #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] increaseAllowance #
    - [Ext] decreaseAllowance #
    - [Ext] getMinimumAccumulationForBooster
    - [Ext] getMinimumAccumulationForLiquidity
    - [Pub] isOverBoosterRequisite
    - [Ext] isExcludedFromFee
    - [Ext] isExcludedFromReward
    - [Ext] totalFees
    - [Ext] deliver #
    - [Ext] reflectionFromToken
    - [Pub] tokenFromReflection
    - [Prv] _approve #
    - [Prv] _transfer #
    - [Prv] _swapAndBoost #
       - modifiers: lockTheSwap
    - [Prv] _swapAndLiquify #
       - modifiers: lockTheSwap
    - [Prv] _swapTokens #
       - modifiers: lockTheSwap
    - [Prv] _swapTokensForEth #
    - [Prv] _swapETHForTokens #
    - [Prv] _tokenTransfer #
    - [Prv] _transferReserve #
    - [Prv] _transferStandard #
    - [Prv] _transferToExcluded #
    - [Prv] _transferFromExcluded #
    - [Prv] _transferBothExcluded #
    - [Prv] _reflectFee #
    - [Prv] _takeTokensForSwappingFees #
    - [Prv] _addLiquidity #
    - [Prv] _removeAllFee #
    - [Prv] _restoreAllFee #
    - [Prv] _getRate
    - [Prv] _getCurrentSupply
    - [Prv] _getValues
    - [Prv] _getTValues
    - [Prv] _getRValues
    - [Prv] _calculateTaxFee
    - [Prv] _calculateSwapFee

 +  Token (Reflective)
    - [Pub]  #
    - [Ext]  ($)
    - [Ext] upsurge #
    - [Ext] unlockLP #
       - modifiers: onlyAuthorized
    - [Ext] unlockHP #
       - modifiers: onlyAuthorized
    - [Ext] setOutpost #
       - modifiers: onlyAuthorized
    - [Ext] setMinimumRequisite #
       - modifiers: onlyAuthorized
    - [Ext] setCooldown #
       - modifiers: onlyAuthorized
    - [Ext] setUP #
       - modifiers: onlyAuthorized
    - [Ext] setCP #
       - modifiers: onlyAuthorized
    - [Ext] setRP #
       - modifiers: onlyAuthorized
    - [Ext] getCooldown
    - [Ext] getClearance
    - [Ext] getUnlockedLPAt
    - [Ext] getLockedTokens
    - [Pub] getCycledLP
    - [Pub] getLockedLP
    - [Pub] getBurnedLP
    - [Ext] getUP
    - [Ext] getCP
    - [Ext] getRP
    - [Pub] getMinimumRequisite
    - [Pub] getLatest
    - [Pub] getGenesis
    - [Pub] getHP
    - [Prv] getRemoveableLP
    - [Prv] _environment
    - [Prv] _time
    - [Prv] _removeLP #

 +  Outpost (Context)
    - [Pub]  #
    - [Ext]  ($)
    - [Ext] recycle #
    - [Prv] _reposition #
    - [Prv] _environment
    - [Prv] _time

Go Home

SourceHat

Surge - Smart Contract Audit Report

Summary

External Threat Results

Function Graph

Inheritence Chart

Functions Overview