add a watermark to the token name

[YouStillAlive]

closes #42

[github-actions]

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• incorrect-equality (2 results) (Medium)
• reentrancy-no-eth (1 results) (Medium)
• uninitialized-local (2 results) (Medium)
• unused-return (9 results) (Medium)
• shadowing-local (2 results) (Low)
• reentrancy-benign (3 results) (Low)
• reentrancy-events (5 results) (Low)
• assembly (1 results) (Informational)
• low-level-calls (6 results) (Informational)
• naming-convention (7 results) (Informational)
• reentrancy-unlimited-gas (1 results) (Informational)

incorrect-equality

Impact: Medium
Confidence: High

• ID-0
  BNBPartyInternal._createFLP(address) uses a dangerous strict equality:
  • IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 7 to 32 in f4cd91f

	function _createFLP(
	address _token
	) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-1
  BNBPartyState.withdrawFee() uses a dangerous strict equality:
  • address(this).balance == 0

BNBParty.Factory/contracts/BNBPartyState.sol

Lines 70 to 76 in f4cd91f

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance);
	emit TransferOutBNB(msg.sender, address(this).balance);
	}

reentrancy-no-eth

Impact: Medium
Confidence: Medium

• ID-2
  Reentrancy in BNBPartyInternal._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:lpToTokenId[msg.sender],liquidity:pool.liquidity(),amount0Min:0,amount1Min:0,deadline:block.timestamp}))
  • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • IERC20(token0).approve(address(positionManager),amount0)
  • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      BNBPartyState.lpToTokenId can be used in cross function reentrancies:
  • BNBPartyState._collectFee(address,INonfungiblePositionManager)
  • BNBPartyState.lpToTokenId

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

uninitialized-local

Impact: Medium
Confidence: Medium

• ID-3
  BNBPartyInternal._createFLP(address).amount0 is a local variable never initialized

BNBParty.Factory/contracts/BNBPartyInternal.sol

Line 11 in f4cd91f

uint256 amount0;

• ID-4
  BNBPartyInternal._createFLP(address).amount1 is a local variable never initialized

BNBParty.Factory/contracts/BNBPartyInternal.sol

Line 12 in f4cd91f

uint256 amount1;

unused-return

Impact: Medium
Confidence: Medium

• ID-5
  BNBPartyInternal._createFLP(address) ignores return value by IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 7 to 32 in f4cd91f

	function _createFLP(
	address _token
	) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-6
  BNBPartyInternal._handleLiquidity(address) ignores return value by IERC20(token1).approve(address(positionManager),amount1)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-7
  BNBPartyInternal._handleLiquidity(address) ignores return value by IERC20(token0).approve(address(positionManager),amount0)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-8
  BNBPartyState._getFeeGrowthInsideLastX128(IUniswapV3Pool) ignores return value by (None,feeGrowthInside0LastX128,feeGrowthInside1LastX128,None,None) = pool.positions(keccak256(bytes)(abi.encodePacked(address(BNBPositionManager),party.tickLower,party.tickUpper)))

BNBParty.Factory/contracts/BNBPartyState.sol

Lines 114 to 134 in f4cd91f

	function _getFeeGrowthInsideLastX128(
	IUniswapV3Pool pool
	)
	internal
	view
	returns (
	uint256 feeGrowthInside0LastX128,
	uint256 feeGrowthInside1LastX128
	)
	{
	(, feeGrowthInside0LastX128, feeGrowthInside1LastX128, , ) = pool
	.positions(
	keccak256(
	abi.encodePacked(
	address(BNBPositionManager),
	party.tickLower,
	party.tickUpper
	)
	)
	);
	}

• ID-9
  BNBPartyInternal._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24) ignores return value by (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 34 to 67 in f4cd91f

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: party.tickLower,
	tickUpper: party.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

• ID-10
  BNBPartyInternal._executeSwap(address,address,address,uint256,uint256) ignores return value by swapRouter.exactInput{value: value}(params)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 137 to 154 in f4cd91f

	function _executeSwap(
	address tokenIn,
	address tokenOut,
	address recipient,
	uint256 amountOutMinimum,
	uint256 amountIn
	) internal notZeroAddress(address(swapRouter)) {
	ISwapRouter.ExactInputParams memory params = ISwapRouter
	.ExactInputParams({
	path: abi.encodePacked(tokenIn, party.partyLpFee, tokenOut),
	recipient: recipient,
	deadline: block.timestamp,
	amountIn: amountIn,
	amountOutMinimum: amountOutMinimum
	});
	uint256 value = msg.value > 0 ? amountIn : 0;
	swapRouter.exactInput{value: value}(params);
	}

• ID-11
  BNBPartyInternal._handleLiquidity(address) ignores return value by BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-12
  BNBPartyState._collectFee(address,INonfungiblePositionManager) ignores return value by manager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[liquidityPool],recipient:msg.sender,amount0Max:type()(uint128).max,amount1Max:type()(uint128).max}))

BNBParty.Factory/contracts/BNBPartyState.sol

Lines 148 to 163 in f4cd91f

	function _collectFee(
	address liquidityPool,
	INonfungiblePositionManager manager
	) internal {
	if (liquidityPool == address(0)) {
	revert ZeroAddress();
	}
	manager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[liquidityPool],
	recipient: msg.sender,
	amount0Max: type(uint128).max,
	amount1Max: type(uint128).max
	})
	);
	}

• ID-13
  BNBPartyInternal._handleLiquidity(address) ignores return value by (sqrtPriceX96,None,None,None,None,None,None) = pool.slot0()

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

shadowing-local

Impact: Low
Confidence: High

• ID-14
  ERC20Token.constructor(string,string,uint256).name shadows:
  • ERC20.name() (function)
  • IERC20Metadata.name() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 9 in f4cd91f

string memory name,

• ID-15
  ERC20Token.constructor(string,string,uint256).symbol shadows:
  • ERC20.symbol() (function)
  • IERC20Metadata.symbol() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 10 in f4cd91f

string memory symbol,

reentrancy-benign

Impact: Low
Confidence: Medium

• ID-16
  Reentrancy in BNBPartyFactory.createParty(string,string):
  External calls:
  • liquidityPool = _createFLP(address(newToken))
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
      State variables written after the call(s):
  • lpToCreator[liquidityPool] = msg.sender

BNBParty.Factory/contracts/BNBPartyFactory.sol

Lines 20 to 41 in f4cd91f

	function createParty(
	string calldata name,
	string calldata symbol
	)
	external
	payable
	override
	nonReentrant
	insufficientBNB
	notZeroAddress(address(BNBPositionManager))
	returns (IERC20 newToken)
	{
	// create new token
	newToken = new ERC20Token(name, symbol, party.initialTokenAmount);
	// create First Liquidity Pool
	address liquidityPool = _createFLP(address(newToken));
	lpToCreator[liquidityPool] = msg.sender;
	if (msg.value > party.createTokenFee) {
	_executeSwap(address(newToken));
	}
	emit StartParty(address(newToken), msg.sender, liquidityPool);
	}

• ID-17
  Reentrancy in BNBPartyInternal._createFLP(address):
  External calls:
  • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • isParty[liquidityPool] = true
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 7 to 32 in f4cd91f

	function _createFLP(
	address _token
	) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	uint256 amount0;
	uint256 amount1;
	if (IERC20(tokenA).balanceOf(address(this)) == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount;
	} else {
	amount1 = party.initialTokenAmount;
	}
	IERC20(_token).approve(
	address(BNBPositionManager),
	party.initialTokenAmount
	);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee
	);
	isParty[liquidityPool] = true;
	}

• ID-18
  Reentrancy in BNBPartyInternal._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24):
  External calls:
  • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    State variables written after the call(s):
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 34 to 67 in f4cd91f

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: party.tickLower,
	tickUpper: party.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

reentrancy-events

Impact: Low
Confidence: Medium

• ID-19
  Reentrancy in BNBPartyInternal._transferBNB(address,uint256):
  External calls:
  • (success,None) = recipient.call{value: amount}()
    Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 80 to 87 in f4cd91f

	function _transferBNB(address recipient, uint256 amount) private {
	// Use call to send BNB
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-20
  Reentrancy in BNBPartyInternal._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:lpToTokenId[msg.sender],liquidity:pool.liquidity(),amount0Min:0,amount1Min:0,deadline:block.timestamp}))
  • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[msg.sender],recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • IERC20(token0).approve(address(positionManager),amount0)
  • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,sqrtPriceX96,party.lpFee)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:party.tickLower,tickUpper:party.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
    • WBNB.withdraw(unwrapAmount)
      External calls sending eth:
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _unwrapAndSendBNB(recipient,unwrapAmount)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 89 to 130 in f4cd91f

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: lpToTokenId[msg.sender],
	liquidity: pool.liquidity(),
	amount0Min: 0,
	amount1Min: 0,
	deadline: block.timestamp
	})
	);
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[msg.sender],
	recipient: address(this),
	amount0Max: uint128(amount0),
	amount1Max: uint128(amount1)
	})
	);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount;
	} else {
	amount1 -= unwrapAmount;
	}
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, sqrtPriceX96, party.lpFee);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	}

• ID-21
  Reentrancy in BNBPartyInternal._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 69 to 78 in f4cd91f

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

• ID-22
  Reentrancy in BNBPartyInternal._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 69 to 78 in f4cd91f

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

• ID-23
  Reentrancy in BNBPartyInternal._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(creator,party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 69 to 78 in f4cd91f

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount);
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator);
	} else {
	_transferBNB(recipient, party.bonusTargetReach);
	_transferBNB(creator, party.bonusPartyCreator);
	}
	}

assembly

Impact: Informational
Confidence: High

• ID-24
  Address._revert(bytes) uses assembly
  • INLINE ASM

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/utils/Address.sol#L146-L158

low-level-calls

Impact: Informational
Confidence: High

• ID-25
  Low level call in SafeERC20._callOptionalReturnBool(IERC20,bytes):
  • (success,returndata) = address(token).call(data)

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#L110-L117

• ID-26
  Low level call in BNBPartyInternal._transferBNB(address,uint256):
  • (success,None) = recipient.call{value: amount}()

BNBParty.Factory/contracts/BNBPartyInternal.sol

Lines 80 to 87 in f4cd91f

	function _transferBNB(address recipient, uint256 amount) private {
	// Use call to send BNB
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-27
  Low level call in Address.functionStaticCall(address,bytes):
  • (success,returndata) = target.staticcall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/utils/Address.sol#L95-L98

• ID-28
  Low level call in Address.functionDelegateCall(address,bytes):
  • (success,returndata) = target.delegatecall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/utils/Address.sol#L104-L107

• ID-29
  Low level call in Address.sendValue(address,uint256):
  • (success,None) = recipient.call{value: amount}()

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/utils/Address.sol#L41-L50

• ID-30
  Low level call in Address.functionCallWithValue(address,bytes,uint256):
  • (success,returndata) = target.call{value: value}(data)

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/utils/Address.sol#L83-L89

naming-convention

Impact: Informational
Confidence: High

• ID-31
  Variable BNBPartyState.WBNB is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 22 in f4cd91f

IWBNB public immutable WBNB;

• ID-32
  Parameter BNBPartyState.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 52 in f4cd91f

INonfungiblePositionManager _BNBPositionManager,

• ID-33
  Variable BNBPartyState.BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 13 in f4cd91f

INonfungiblePositionManager public BNBPositionManager; // BNB Party position manager

• ID-34
  Parameter BNBPartyState.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._positionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 53 in f4cd91f

INonfungiblePositionManager _positionManager

• ID-35
  Parameter BNBPartyState.setSwapRouter(ISwapRouter)._swapRouter is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 62 in f4cd91f

function setSwapRouter(ISwapRouter _swapRouter) external onlyOwner {

• ID-36
  Function INonfungiblePositionManager.WETH9() is not in mixedCase

BNBParty.Factory/contracts/interfaces/INonfungiblePositionManager.sol

Line 184 in f4cd91f

function WETH9() external view returns (address);

• ID-37
  Function IERC20Permit.DOMAIN_SEPARATOR() is not in mixedCase

https://github.com/bnb-party/BNBParty.Factory/blob/f4cd91fc826b97101525f742e576a4bfa3c93891/node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Permit.sol#L89

reentrancy-unlimited-gas

Impact: Informational
Confidence: Medium

• ID-38
  Reentrancy in BNBPartyState.withdrawFee():
  External calls:
  • address(msg.sender).transfer(address(this).balance)
    Event emitted after the call(s):
  • TransferOutBNB(msg.sender,address(this).balance)

BNBParty.Factory/contracts/BNBPartyState.sol

Lines 70 to 76 in f4cd91f

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance);
	emit TransferOutBNB(msg.sender, address(this).balance);
	}

[github-actions]

Methods

Symbol	Meaning
◯	Execution gas for this method does not include intrinsic gas overhead
△	Cost was non-zero but below the precision setting for the currency display (see options)

	Min	Max	Avg	Calls	usd avg
BNBPartyFactory
createParty(string,string)	5,668,766	5,882,454	5,723,205	31	3.36
joinParty(address,uint256)	153,302	5,653,179	1,819,582	20	1.07
leaveParty(address,uint256,uint256)	174,469	191,569	180,169	3	0.11
setNonfungiblePositionManager(address,address)	27,399	68,928	66,159	15	0.04
setSwapRouter(address)	24,119	46,259	44,783	15	0.03
withdrawFee()	-	-	31,792	2	0.02
withdrawPartyLPFee(address[])	-	-	173,875	2	0.10
NonfungiblePositionManager
approve(address,uint256)	46,052	46,383	46,273	3	0.03
SwapRouter
exactInput((bytes,address,uint256,uint256,uint256))	132,707	142,139	138,995	3	0.08
multicall(bytes[])	-	-	160,866	2	0.09

Deployments

	Min	Max	Avg	Block %	usd avg
BNBPartyFactory	3,323,047	3,323,059	3,323,058	2.6 %	1.95
MockNonfungibleTokenPositionDescriptor	-	-	111,537	0.1 %	0.07
NonfungiblePositionManager	5,171,500	5,171,524	5,171,519	4 %	3.04
SwapRouter	2,201,066	2,201,090	2,201,088	1.7 %	1.29
UniswapV3Factory	5,437,097	5,437,109	5,437,107	4.2 %	3.19

Solidity and Network Config

Settings	Value
Solidity: version	0.8.24
Solidity: optimized	true
Solidity: runs	200
Solidity: viaIR	false
Block Limit	130,000,000
L1 Gas Price	1 gwei
Token Price	587.36 usd/bnb
Network	BINANCE
Toolchain	hardhat