uups-checker 1.0.0

package/audits/AiFi-security-audit-20260326.md

@@ -0,0 +1,499 @@
+# AiFi Token (AiFi) Security Audit Report
+
+**Contract Address:** `0xdb953299588b7a7c38044bcd004b4b1892026333`  
+**Chain:** BSC (BNB Smart Chain)  
+**Token Name:** Ai DeFi (AiFi)  
+**Compiler:** v0.8.24+commit.e11b9ed9  
+**Optimization:** Yes with 200 runs  
+**Audit Date:** March 26, 2026  
+**Auditor:** Automated Security Analysis
+
+---
+
+## Executive Summary
+
+The AiFi token is a complex DeFi token with dividend distribution, LP tracking, anti-bot mechanisms, and dynamic fee structures. The contract is **VERIFIED** on BSCScan and uses OpenZeppelin contracts.
+
+### Risk Assessment: 🟡 MEDIUM-HIGH RISK
+
+**Overall Risk Level:** MEDIUM-HIGH - Multiple centralization risks and complex mechanisms
+
+**Key Findings:**
+- ✅ Contract is verified on BSCScan
+- ⚠️ High centralization - Owner has extensive control
+- ⚠️ Complex fee structure with time-based variations
+- ⚠️ Blacklist functionality can block users
+- ⚠️ LP manipulation restrictions
+- ⚠️ External contract dependencies (dividend trackers)
+- ⚠️ No ownership renouncement
+
+---
+
+## Contract Overview
+
+**Total Supply:** 21,000,000 AiFi  
+**Decimals:** 18  
+**Token Standard:** ERC20 (OpenZeppelin)  
+**Router:** PancakeSwap V2 (0x10ED43C718714eb63d5aA57B78B54704E256024E)
+
+### Key Features:
+1. Dynamic fee structure (time-based)
+2. LP dividend distribution
+3. NFT dividend distribution  
+4. Anti-bot mechanisms
+5. Wallet limits
+6. Blacklist/Whitelist system
+7. LP tracking and restrictions
+
+---
+
+## Critical Findings
+
+### 1. ⚠️ CENTRALIZATION RISKS - HIGH SEVERITY
+
+**Description:**
+The owner has extensive control over critical contract parameters:
+
+```solidity
+function setBuyFee(Fee memory _fee) external onlyOwner
+function setSellFee(Fee memory _fee) external onlyOwner
+function setBlackList(address[] memory addrs, bool b) external onlyOwner
+function setWhiteList(address[] memory addrs, bool b) external onlyOwner
+function setLimitAmount(uint256 amount) external onlyOwner
+function updateLPAmount(address account, uint256 lpAmount) public onlyOwner
+function setDappContract(address addr) external onlyOwner
+```
+
+**Impact:**
+- Owner can change fees at any time (no max limits enforced in setter)
+- Owner can blacklist any address
+- Owner can manipulate LP amounts
+- Owner can change critical addresses
+
+**Current Fee Limits:**
+- Initial buy fee: 15% (high), 2% (normal)
+- Initial sell fee: 15% (high), 2% (normal)
+- No hardcoded maximum in setter functions
+
+**Recommendation:**
+- Implement maximum fee caps (e.g., 10%)
+- Add timelock for critical parameter changes
+- Consider renouncing ownership after setup
+- Use multi-sig for owner functions
+
+---
+
+### 2. ⚠️ BLACKLIST FUNCTIONALITY - MEDIUM SEVERITY
+
+**Description:**
+```solidity
+mapping(address => bool) public blackList;
+
+function setBlackList(address[] memory addrs, bool b) external onlyOwner {
+    for (uint256 i = 0; i < addrs.length; i++) {
+        blackList[addrs[i]] = b;
+    }
+}
+
+// In _beforeTransfer:
+require(!blackList[from] || whileList[to] || whileList[from], "bl");
+```
+
+**Impact:**
+- Owner can block any address from transferring tokens
+- Blacklisted users cannot sell or transfer
+- Potential for abuse or regulatory issues
+
+**Recommendation:**
+- Document clear blacklist criteria
+- Consider removing blacklist after launch
+- Implement appeal mechanism
+
+---
+
+### 3. ⚠️ COMPLEX LP RESTRICTIONS - MEDIUM SEVERITY
+
+**Description:**
+The contract has strict LP add/remove restrictions:
+
+```solidity
+// LP Add restrictions:
+require(to == usdtPair, "not allow add");  // Only USDT pair
+require(user == tx.origin, "not owner1");  // No contracts
+require(!isContract(user), "not owner2");  // Double check
+
+// LP Remove restrictions:
+require(from == usdtPair && startTradeBlock > 0, "not remove");
+require(userInfo[user].lpAmount >= removeLPLiquidity, "lp min");
+require(userInfo[user].lastAddLPTime != block.timestamp, "lp error");
+```
+
+**Impact:**
+- Users can only add LP to USDT pair
+- Cannot add/remove LP in same block
+- Contracts cannot provide liquidity
+- May limit legitimate use cases
+
+**Recommendation:**
+- Document LP restrictions clearly
+- Consider allowing WBNB pair LP
+- Review contract exclusion necessity
+
+---
+
+### 4. ⚠️ DAPP CONTRACT PRIVILEGES - MEDIUM SEVERITY
+
+**Description:**
+```solidity
+address public dappContract;
+
+function setLock(bool v) external {
+    require(_msgSender() == dappContract, "only dapp");
+    inLaunchBuyLock = v;
+}
+
+function recycleByDapp(uint256 amount) external {
+    require(_msgSender() == dappContract, "only dapp");
+    uint256 maxBurn = balanceOf(mainPair) / 3;
+    uint256 burnAmount = amount >= maxBurn ? maxBurn : amount;
+    _transfer(mainPair, dappContract, burnAmount);
+    IPancakePair(mainPair).sync();
+}
+```
+
+**Impact:**
+- Dapp contract can lock/unlock trading
+- Dapp contract can extract up to 33% of LP tokens
+- Centralized control point
+- Potential for manipulation
+
+**Recommendation:**
+- Clearly document dapp contract purpose
+- Implement timelock for dapp actions
+- Consider removing after launch
+- Audit dapp contract separately
+
+---
+
+## High Severity Findings
+
+### 5. 🔴 EXTERNAL DEPENDENCY RISKS
+
+**Description:**
+The contract depends on external contracts for critical functionality:
+
+```solidity
+ICalculateReward public nftDividendTracker;
+ICalculateReward public lpDividendTracker;
+IDividendCalculator public dividendCalculator;
+
+// These can be changed by owner:
+function setNftDividendTracker(address _dividendTracker) external onlyOwner
+function setLpDividendTracker(address _dividendTracker) external onlyOwner
+function setDividendCalculator(address _dividendCalculator) external onlyOwner
+```
+
+**Impact:**
+- Owner can change dividend contracts at any time
+- Malicious contracts could drain funds
+- No validation of new contract addresses
+- Users' dividend rights depend on external contracts
+
+**Recommendation:**
+- Audit all external contracts
+- Implement address validation
+- Add timelock for changes
+- Consider making addresses immutable after setup
+
+---
+
+### 6. 🔴 TIME-BASED FEE MANIPULATION
+
+**Description:**
+```solidity
+uint256 public highFeeSeconds = 60;      // 1 minute
+uint256 public middleFeeSeconds = 3600;  // 1 hour
+uint256 public lowFeeSeconds = 86400;    // 1 day
+
+// Initial fees:
+buyFee = Fee(1500, 200, 200, 200);   // 15%, 2%, 2%, 2%
+sellFee = Fee(1500, 0, 0, 200);      // 15%, 0%, 0%, 2%
+
+// Owner can change these:
+function setMarketTime(uint256 _highFeeSeconds, uint256 _middleFeeSeconds, uint256 _lowFeeSeconds) external onlyOwner
+```
+
+**Impact:**
+- First minute: 15% buy/sell fee (anti-sniper)
+- First hour: 2% buy fee, 0% sell fee
+- First day: 2% buy/sell fee
+- After: 2% buy/sell fee
+- Owner can extend high fee periods
+
+**Recommendation:**
+- Document fee schedule clearly
+- Implement maximum fee duration
+- Consider removing time-based fees after launch
+
+---
+
+## Medium Severity Findings
+
+### 7. ⚠️ WALLET LIMIT BYPASS
+
+**Description:**
+```solidity
+uint256 public limitAmount = 10000 * 1 ether; // 10,000 tokens
+
+if (!pairs[to] && limitAmount > 0) {
+    require(balanceOf(to) + newValue <= limitAmount, "limit wallet");
+}
+```
+
+**Impact:**
+- Limit only applies to non-pair addresses
+- Owner can change limit at any time
+- Whitelisted addresses bypass limit
+- May not effectively prevent whales
+
+**Recommendation:**
+- Consider removing limit after distribution
+- Document whale prevention strategy
+- Review whitelist carefully
+
+---
+
+### 8. ⚠️ DIVIDEND DISTRIBUTION COMPLEXITY
+
+**Description:**
+```solidity
+function _autoDividendDaily() internal {
+    uint256 round = 1;
+    uint256 day = block.timestamp / 1 days;
+    uint256 sec = block.timestamp - (day * 1 days);
+    if (sec >= 43200) {  // 12 hours
+        round = 2;
+    }
+    // ... complex distribution logic
+}
+```
+
+**Impact:**
+- Automatic dividend distribution twice daily
+- Complex calculation dependencies
+- Gas-intensive operations
+- Potential for distribution failures
+
+**Recommendation:**
+- Thoroughly test dividend logic
+- Monitor gas costs
+- Implement fallback mechanisms
+- Document distribution schedule
+
+---
+
+### 9. ⚠️ SWAP MECHANISM RISKS
+
+**Description:**
+```solidity
+function swapTokenForFee() private lockTheSwap {
+    uint256 lPDividendAmount = balanceOf(address(this));
+    // ... swap logic
+    uniswapV2Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
+        lPDividendAmount,
+        1,  // minAmountOut = 1 (no slippage protection!)
+        path_usdt,
+        address(tokenDistributor),
+        block.timestamp + 1
+    );
+}
+```
+
+**Impact:**
+- Minimal slippage protection (minAmountOut = 1)
+- Vulnerable to sandwich attacks
+- Could result in poor swap rates
+- Fees may be lost to MEV
+
+**Recommendation:**
+- Implement proper slippage protection (e.g., 5%)
+- Use oracle for price validation
+- Consider private mempool
+- Monitor swap efficiency
+
+---
+
+## Low Severity Findings
+
+### 10. ℹ️ EIP-7702 CHECK
+
+**Description:**
+```solidity
+function isEIP7702(address addr) internal view returns (bool) {
+    // Checks for EIP-7702 delegation
+    bytes memory code = new bytes(3);
+    assembly {
+        extcodecopy(addr, add(code, 0x20), 0, 3)
+    }
+    return code[0] == 0xef && code[1] == 0x01 && code[2] == 0x00;
+}
+```
+
+**Impact:**
+- Future-proofing for EIP-7702
+- May not be necessary on BSC
+- Adds gas cost
+
+**Recommendation:**
+- Document purpose
+- Consider removing if not needed on BSC
+
+---
+
+### 11. ℹ️ TYPO IN VARIABLE NAME
+
+**Description:**
+```solidity
+mapping(address => bool) public whileList;  // Should be "whiteList"
+```
+
+**Impact:**
+- Confusing variable name
+- No functional impact
+- Reduces code readability
+
+**Recommendation:**
+- Fix typo in future versions
+- Update documentation
+
+---
+
+## Gas Optimization Opportunities
+
+### 1. Unchecked Arithmetic
+```solidity
+// Current:
+for (uint256 i = 0; i < addrs.length; i++) {
+
+// Optimized:
+for (uint256 i; i < addrs.length;) {
+    // ...
+    unchecked { ++i; }
+}
+```
+
+### 2. Storage Packing
+Consider packing boolean flags into a single uint256 to save gas.
+
+### 3. Immutable Variables
+Some addresses could be marked immutable if they don't change.
+
+---
+
+## Positive Security Features
+
+✅ **OpenZeppelin Contracts:** Uses audited OZ contracts  
+✅ **ReentrancyGuard:** Protected swap function  
+✅ **Verified Source:** Contract is verified on BSCScan  
+✅ **No Proxy:** Direct implementation (no upgrade risk)  
+✅ **LP Lock Mechanism:** Prevents instant LP removal  
+✅ **Anti-Bot:** Time-based fees and restrictions  
+✅ **Dividend System:** Rewards LP providers and NFT holders
+
+---
+
+## Recommendations Summary
+
+### Critical Priority:
+1. Implement maximum fee caps (10% max)
+2. Add timelock for critical parameter changes
+3. Audit external dividend contracts
+4. Improve slippage protection in swaps
+5. Document dapp contract purpose and audit it
+
+### High Priority:
+6. Consider renouncing ownership after setup
+7. Implement multi-sig for owner functions
+8. Add validation for external contract addresses
+9. Document blacklist criteria and usage
+10. Review and potentially remove dapp privileges
+
+### Medium Priority:
+11. Fix "whileList" typo
+12. Optimize gas usage
+13. Add emergency pause mechanism
+14. Implement better MEV protection
+15. Document all restrictions clearly
+
+---
+
+## Testing Recommendations
+
+### Unit Tests Needed:
+- Fee calculation accuracy
+- LP add/remove restrictions
+- Dividend distribution logic
+- Blacklist functionality
+- Time-based fee transitions
+- Swap mechanism
+- Dapp contract interactions
+
+### Integration Tests:
+- PancakeSwap integration
+- Dividend tracker integration
+- Multi-user scenarios
+- Edge cases (same-block LP operations)
+
+### Fuzzing Targets:
+- Fee calculations
+- LP liquidity calculations
+- Dividend distributions
+- Transfer logic with various states
+
+---
+
+## Conclusion
+
+**FINAL VERDICT: 🟡 MEDIUM-HIGH RISK**
+
+The AiFi token is a complex DeFi token with multiple advanced features. While it uses audited OpenZeppelin contracts and has some good security practices, it suffers from significant centralization risks and complex mechanisms that could be exploited.
+
+### Risk Score: 6.5/10
+
+**Key Concerns:**
+1. High centralization (owner controls fees, blacklist, LP amounts)
+2. External contract dependencies (dividend trackers)
+3. Dapp contract privileges (can extract LP tokens)
+4. Complex LP restrictions
+5. Minimal slippage protection in swaps
+6. No ownership renouncement plan
+
+### Recommendations for Users:
+- ⚠️ **Proceed with caution** - High centralization risk
+- 📊 Monitor owner actions closely
+- 🔍 Verify dividend tracker contracts
+- ⏰ Be aware of time-based fees
+- 💰 Understand LP restrictions before providing liquidity
+- 🚫 Risk of blacklisting exists
+
+### Recommendations for Team:
+1. Implement fee caps and timelocks
+2. Audit all external contracts
+3. Document all mechanisms clearly
+4. Consider decentralization roadmap
+5. Improve slippage protection
+6. Add emergency mechanisms
+
+---
+
+## Disclaimer
+
+This audit report is based on the verified source code at the time of analysis. The contract's behavior depends on external contracts (dividend trackers, dapp contract) which were not audited. Users should conduct their own research and understand the risks before interacting with this token.
+
+**This is not financial advice. Always DYOR.**
+
+---
+
+**Report Generated:** March 26, 2026  
+**Contract Status:** VERIFIED ✅  
+**Recommendation:** CAUTION - Medium-High Risk 🟡