contract refactor

[YouStillAlive]

closes #40

[github-actions]

Methods

Symbol	Meaning
◯	Execution gas for this method does not include intrinsic gas overhead
△	Cost was non-zero but below the precision setting for the currency display (see options)

	Min	Max	Avg	Calls	usd avg
BNBPartyFactory
createParty(string,string)	5,668,459	5,882,147	5,728,542	29	3.36
joinParty(address,uint256)	153,302	5,642,318	1,818,734	20	1.07
leaveParty(address,uint256,uint256)	174,469	191,569	180,169	3	0.11
setNonfungiblePositionManager(address,address)	27,399	68,928	66,158	15	0.04
setSwapRouter(address)	24,119	46,259	44,782	15	0.03
withdrawFee()	-	-	31,792	2	0.02
withdrawPartyLPFee(address[])	173,835	173,880	173,858	2	0.10
NonfungiblePositionManager
approve(address,uint256)	46,052	46,383	46,273	3	0.03
SwapRouter
exactInput((bytes,address,uint256,uint256,uint256))	132,707	142,139	138,995	3	0.08
multicall(bytes[])	-	-	160,866	2	0.09

Deployments

	Min	Max	Avg	Block %	usd avg
BNBPartyFactory	3,306,916	3,306,928	3,306,927	2.5 %	1.94
MockNonfungibleTokenPositionDescriptor	-	-	111,537	0.1 %	0.07
NonfungiblePositionManager	5,171,500	5,171,524	5,171,519	4 %	3.04
SwapRouter	2,201,078	2,201,090	2,201,088	1.7 %	1.29
UniswapV3Factory	5,437,097	5,437,109	5,437,108	4.2 %	3.19

Solidity and Network Config

Settings	Value
Solidity: version	0.8.24
Solidity: optimized	true
Solidity: runs	200
Solidity: viaIR	false
Block Limit	130,000,000
L1 Gas Price	1 gwei
Token Price	587.17 usd/bnb
Network	BINANCE
Toolchain	hardhat

[github-actions]

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• incorrect-equality (2 results) (Medium)
• reentrancy-no-eth (1 results) (Medium)
• uninitialized-local (2 results) (Medium)
• unused-return (9 results) (Medium)
• shadowing-local (2 results) (Low)
• reentrancy-benign (3 results) (Low)
• reentrancy-events (5 results) (Low)
• assembly (1 results) (Informational)
• low-level-calls (6 results) (Informational)
• naming-convention (7 results) (Informational)
• reentrancy-unlimited-gas (1 results) (Informational)
• unused-import (1 results) (Informational)

incorrect-equality

Impact: Medium
Confidence: High

• ID-0
  BNBPartyLiquidity._createFLP(address) uses a dangerous strict equality:
  • IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 7 to 30 in 02990fa

	function _createFLP(address _token) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-1
  BNBPartyManageable.withdrawFee() uses a dangerous strict equality:
  • address(this).balance == 0

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 26 to 32 in 02990fa

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance);
	emit TransferOutBNB(msg.sender, address(this).balance);
	}

reentrancy-no-eth

Impact: Medium
Confidence: Medium

• ID-2
  Reentrancy in BNBPartyLiquidity._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:lpToTokenId[msg.sender],liquidity:pool.liquidity(),amount0Min:0,amount1Min:0,deadline:block.timestamp}))
  • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • IERC20(token0).approve(address(positionManager),amount0)
  • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      BNBPartyState.lpToTokenId can be used in cross function reentrancies:
  • BNBPartyState.lpToTokenId

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

uninitialized-local

Impact: Medium
Confidence: Medium

• ID-3
  BNBPartyLiquidity._createFLP(address).amount1 is a local variable never initialized

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Line 10 in 02990fa

uint256 amount1;

• ID-4
  BNBPartyLiquidity._createFLP(address).amount0 is a local variable never initialized

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Line 9 in 02990fa

uint256 amount0;

unused-return

Impact: Medium
Confidence: Medium

• ID-5
  BNBPartyLiquidity._handleLiquidity(address) ignores return value by BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-6
  BNBPartySwaps._executeSwap(address,address,address,uint256,uint256) ignores return value by swapRouter.exactInput{value: value}(params)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 32 to 49 in 02990fa

	function _executeSwap(
	address tokenIn,
	address tokenOut,
	address recipient,
	uint256 amountOutMinimum,
	uint256 amountIn
	) internal notZeroAddress(address(swapRouter)) {
	ISwapRouter.ExactInputParams memory params = ISwapRouter
	.ExactInputParams({
	path: abi.encodePacked(tokenIn, party.partyLpFee, tokenOut),
	recipient: recipient,
	deadline: block.timestamp,
	amountIn: amountIn,
	amountOutMinimum: amountOutMinimum
	});
	uint256 value = msg.value > 0 ? amountIn : 0;
	swapRouter.exactInput{value: value}(params);
	}

• ID-7
  BNBPartyLiquidity._createFLP(address) ignores return value by IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 7 to 30 in 02990fa

	function _createFLP(address _token) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-8
  BNBPartyManageable._collectFee(address,INonfungiblePositionManager) ignores return value by manager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[liquidityPool],recipient:msg.sender,amount0Max:type()(uint128).max,amount1Max:type()(uint128).max}))

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 59 to 71 in 02990fa

	function _collectFee(
	address liquidityPool,
	INonfungiblePositionManager manager
	) internal notZeroAddress(liquidityPool) {
	manager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[liquidityPool],
	recipient: msg.sender,
	amount0Max: type(uint128).max,
	amount1Max: type(uint128).max
	})
	);
	}

• ID-9
  BNBPartyLiquidity._handleLiquidity(address) ignores return value by (sqrtPriceX96,None,None,None,None,None,None) = pool.slot0()

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-10
  BNBPartyView._getFeeGrowthInsideLastX128(IUniswapV3Pool) ignores return value by (None,feeGrowthInside0LastX128,feeGrowthInside1LastX128,None,None) = pool.positions(keccak256(bytes)(abi.encodePacked(address(BNBPositionManager),party.tickLower,party.tickUpper)))

BNBParty.Factory/contracts/BNBPartyView.sol

Lines 40 to 60 in 02990fa

	function _getFeeGrowthInsideLastX128(
	IUniswapV3Pool pool
	)
	internal
	view
	returns (
	uint256 feeGrowthInside0LastX128,
	uint256 feeGrowthInside1LastX128
	)
	{
	(, feeGrowthInside0LastX128, feeGrowthInside1LastX128, , ) = pool
	.positions(
	keccak256(
	abi.encodePacked(
	address(BNBPositionManager),
	party.tickLower,
	party.tickUpper
	)
	)
	);
	}

• ID-11
  BNBPartyLiquidity._handleLiquidity(address) ignores return value by IERC20(token1).approve(address(positionManager),amount1)

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-12
  BNBPartyLiquidity._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24) ignores return value by (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 32 to 65 in 02990fa

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: party.tickLower,
	tickUpper: party.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

• ID-13
  BNBPartyLiquidity._handleLiquidity(address) ignores return value by IERC20(token0).approve(address(positionManager),amount0)

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

shadowing-local

Impact: Low
Confidence: High

• ID-14
  ERC20Token.constructor(string,string,uint256).name shadows:
  • ERC20.name() (function)
  • IERC20Metadata.name() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 9 in 02990fa

string memory name,

• ID-15
  ERC20Token.constructor(string,string,uint256).symbol shadows:
  • ERC20.symbol() (function)
  • IERC20Metadata.symbol() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 10 in 02990fa

string memory symbol,

reentrancy-benign

Impact: Low
Confidence: Medium

• ID-16
  Reentrancy in BNBPartyLiquidity._createFLP(address):
  External calls:
  • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • isParty[liquidityPool] = true
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 7 to 30 in 02990fa

	function _createFLP(address _token) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-17
  Reentrancy in BNBPartyFactory.createParty(string,string):
  External calls:
  • liquidityPool = _createFLP(address(newToken))
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
      State variables written after the call(s):
  • lpToCreator[liquidityPool] = msg.sender

BNBParty.Factory/contracts/BNBPartyFactory.sol

Lines 21 to 42 in 02990fa

	function createParty(
	string calldata name,
	string calldata symbol
	)
	external
	payable
	override
	nonReentrant
	insufficientBNB
	notZeroAddress(address(BNBPositionManager))
	returns (IERC20 newToken)
	{
	// create new token
	newToken = new ERC20Token(name, symbol, party.initialTokenAmount);
	// create First Liquidity Pool
	address liquidityPool = _createFLP(address(newToken));
	lpToCreator[liquidityPool] = msg.sender;
	if (msg.value > party.createTokenFee) {
	_executeSwap(address(newToken));
	}
	emit StartParty(address(newToken), msg.sender, liquidityPool);
	}

• ID-18
  Reentrancy in BNBPartyLiquidity._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24):
  External calls:
  • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    State variables written after the call(s):
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 32 to 65 in 02990fa

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: party.tickLower,
	tickUpper: party.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

reentrancy-events

Impact: Low
Confidence: Medium

• ID-19
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 7 to 16 in 02990fa

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

• ID-20
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 7 to 16 in 02990fa

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

• ID-21
  Reentrancy in BNBPartySwaps._transferBNB(address,uint256):
  External calls:
  • (success,None) = recipient.call{value: amount}()
    Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 18 to 25 in 02990fa

	function _transferBNB(address recipient, uint256 amount) private {
	// Use call to send BNB
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-22
  Reentrancy in BNBPartyLiquidity._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:lpToTokenId[msg.sender],liquidity:pool.liquidity(),amount0Min:0,amount1Min:0,deadline:block.timestamp}))
  • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • IERC20(token0).approve(address(positionManager),amount0)
  • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • WBNB.withdraw(unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _unwrapAndSendBNB(recipient,unwrapAmount)

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 67 to 108 in 02990fa

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-23
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(creator,party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 7 to 16 in 02990fa

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

assembly

Impact: Informational
Confidence: High

• ID-24
  Address._revert(bytes) uses assembly
  • INLINE ASM

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/utils/Address.sol#L146-L158

low-level-calls

Impact: Informational
Confidence: High

• ID-25
  Low level call in SafeERC20._callOptionalReturnBool(IERC20,bytes):
  • (success,returndata) = address(token).call(data)

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#L110-L117

• ID-26
  Low level call in Address.functionStaticCall(address,bytes):
  • (success,returndata) = target.staticcall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/utils/Address.sol#L95-L98

• ID-27
  Low level call in Address.functionDelegateCall(address,bytes):
  • (success,returndata) = target.delegatecall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/utils/Address.sol#L104-L107

• ID-28
  Low level call in Address.sendValue(address,uint256):
  • (success,None) = recipient.call{value: amount}()

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/utils/Address.sol#L41-L50

• ID-29
  Low level call in BNBPartySwaps._transferBNB(address,uint256):
  • (success,None) = recipient.call{value: amount}()

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 18 to 25 in 02990fa

	function _transferBNB(address recipient, uint256 amount) private {
	// Use call to send BNB
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-30
  Low level call in Address.functionCallWithValue(address,bytes,uint256):
  • (success,returndata) = target.call{value: value}(data)

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/utils/Address.sol#L83-L89

naming-convention

Impact: Informational
Confidence: High

• ID-31
  Variable BNBPartyState.WBNB is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 22 in 02990fa

IWBNB public immutable WBNB;

• ID-32
  Variable BNBPartyState.BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 13 in 02990fa

INonfungiblePositionManager public BNBPositionManager; // BNB Party position manager

• ID-33
  Parameter BNBPartyManageable.setSwapRouter(ISwapRouter)._swapRouter is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 18 in 02990fa

function setSwapRouter(ISwapRouter _swapRouter) external onlyOwner {

• ID-34
  Parameter BNBPartyManageable.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 8 in 02990fa

INonfungiblePositionManager _BNBPositionManager,

• ID-35
  Function INonfungiblePositionManager.WETH9() is not in mixedCase

BNBParty.Factory/contracts/interfaces/INonfungiblePositionManager.sol

Line 184 in 02990fa

function WETH9() external view returns (address);

• ID-36
  Parameter BNBPartyManageable.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._positionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 9 in 02990fa

INonfungiblePositionManager _positionManager

• ID-37
  Function IERC20Permit.DOMAIN_SEPARATOR() is not in mixedCase

https://github.com/bnb-party/BNBParty.Factory/blob/02990fad50a33f683d4d880c965be2c45227cfe4/node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Permit.sol#L89

reentrancy-unlimited-gas

Impact: Informational
Confidence: Medium

• ID-38
  Reentrancy in BNBPartyManageable.withdrawFee():
  External calls:
  • address(msg.sender).transfer(address(this).balance)
    Event emitted after the call(s):
  • TransferOutBNB(msg.sender,address(this).balance)

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 26 to 32 in 02990fa

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance);
	emit TransferOutBNB(msg.sender, address(this).balance);
	}

unused-import

Impact: Informational
Confidence: High

• ID-39
  The following unused import(s) in contracts/BNBPartyState.sol should be removed:
  -import "./interfaces/IUniswapV3Pool.sol"; (contracts/BNBPartyState.sol#9)