BuyTruth

Smart Contract Audit Report

Audit Summary

BuyTruth is a new ERC-20 token on Ethereum that allows holders to claim rewards.

For this audit, we reviewed the project team's BuyTruth contract at 0xFB8A515477dC93bf91F4d78B63ca7632E39cD235 on the Ethereum Mainnet.

Audit Findings

All findings have been resolved.
Date: October 25th, 2023.
Updated: October 26th, 2023 to reflect the project's latest Testnet address that resolves Finding #1.
Updated: October 27th, 2023 to reflect the project's Mainnet address.
Updated: November 6th, 2023 after the project team renounced ownership.

Finding #1 - BuyTruth - Low (Resolved)

Description: In the calculatePenaltyPercent() function, a value of zero is returned when the daysHeld calculation results in 89 days due to the automatic truncation of decimals in Solidity.
Risk/Impact: A penalty will not be applied for users that have held tokens for 89 days which does not align with the project team's 90-day intent.
Recommendation: The team should modify calculatePenaltyPercent() function to return a 1% minimum penalty if daysHeld is equal to 89. Alternatively, the team could enhance the precision of the calculations in the calculatePenaltyPercent() function by introducing a multiplier to the initial calculation, and subsequently dividing by the multiplier.
Resolution: The team has introduced a multiplier to enhance precision.

Contract Overview

• The total supply of the token is currently ~7.41 billion $TRUTH [7,414,417,868].
• No mint or burn functions are publicly accessible, though the circulating supply can be decreased by sending tokens to the 0x..dead address.
• At the time of writing this report, there are 142 total token holders. The token allocation is as follows:
• 20.39% of the total supply is in Uniswap V3 liquidity.
• Liquidity is secured through an NFT which is locked in a UNCX token locking contract and will unlock on July 4th, 2025.
• 10.47% of the total supply belongs to the BuyTruth contract.
• The next five holders own a cumulative 12.58% of the total supply.


• The contract's launch block must be reached in order for all transfers to take place on the platform. Only the owner can initiate transfers before the launch block has been reached.
• The contract features an Anti-Whale mechanism that prevents users from buying more than 1% of the current total supply per transaction before the Anti-Whale block has been reached.
• A penalty is applied on sells and peer-to-peer transfers initiated by non-exempt addresses if the caller has purchased tokens within the past 90 days.
• The penalty percentage is calculated based on the number of days since tokens were last purchased by the user. The penalty is proportionally reduced for each day held, with the penalty reaching zero after 90 days.
• The penalty is charged on top of the transfer amount. The caller must have a sufficient token balance to support the transfer amount and penalty amount in order for the transaction to successfully occur.
• The additional tokens collected through the penalty are distributed as follows:
  • 45% of the tokens are transferred to the contract to fund rewards.
  • 30% of the tokens are burned, reducing the total supply.
  • 15% of the tokens are sent to the Charity wallet set by the team.
  • 10% of the tokens are sent to the Dev wallet set by the team.
• Users that have purchased tokens since their last reward claim are eligible to claim rewards. The amount of rewards they can claim is calculated based on the proportion of their recent purchases to the entire supply of tokens eligible for rewards, relative to the total rewards available in the contract.
• After rewards are successfully claimed, the user's "days-held" counter is reset to zero.
• Ownership has been renounced by the team.
• The owner was previously able to set the launch block and Anti-Whale block to any values before the first purchase has taken place.
• The LP Maintainer address can add/remove any address from the Liquidity pool list at any time.
• As the contract is deployed with Solidity v0.8.21, it is safe from any possible overflows/underflows.
• The contract complies with the ERC-20 token standard.

Audit Results

Inheritance Chart

Function Graph

Functions Overview

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public

 + [Int] IERC20 
    - [Ext] totalSupply
    - [Ext] balanceOf
    - [Ext] transfer #
    - [Ext] allowance
    - [Ext] approve #
    - [Ext] transferFrom #

 + [Int] IERC20Metadata (IERC20)
    - [Ext] name
    - [Ext] symbol
    - [Ext] decimals

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 +  ERC20 (Context, IERC20, IERC20Metadata)
    - [Pub]  #
    - [Pub] name
    - [Pub] symbol
    - [Pub] decimals
    - [Pub] totalSupply
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] allowance
    - [Pub] approve #
    - [Pub] transferFrom #
    - [Pub] increaseAllowance #
    - [Pub] decreaseAllowance #
    - [Int] _transfer #
    - [Int] _mint #
    - [Int] _burn #
    - [Int] _approve #
    - [Int] _spendAllowance #
    - [Int] _beforeTokenTransfer #
    - [Int] _afterTokenTransfer #

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Int] _checkOwner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Int] _transferOwnership #

 +  BuyTruth (ERC20, Ownable)
    - [Pub]  #
    - [Ext] updateLaunchBlocks #
       - modifiers: onlyOwner
    - [Pub] transfer #
    - [Pub] transferFrom #
    - [Pub] balanceOf
    - [Pub] balanceTotalOf
    - [Pub] numDaysHeld
    - [Pub] calculatePenaltyPercentWithMultiplier
    - [Int] _applyPenalty #
    - [Pub] availableRewards
    - [Ext] claimRewards #
    - [Int] _isExempt
    - [Ext] devAddress
    - [Ext] charityAddress
    - [Ext] totalBurned
    - [Ext] rewardsPoolBalance
    - [Ext] balanceEligibleForRewards
    - [Ext] supplyEligibleForRewards
    - [Ext] blocksTillLaunch
    - [Ext] addLiquidityPool #
       - modifiers: lpMaintainer
    - [Ext] removeLiquidityPool #
       - modifiers: lpMaintainer

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home