refactor party

[YouStillAlive]

No description provided.

[github-actions]

Methods

Symbol	Meaning
◯	Execution gas for this method does not include intrinsic gas overhead
△	Cost was non-zero but below the precision setting for the currency display (see options)

	Min	Max	Avg	Calls	usd avg
BNBPartyFactory
createParty(string,string)	5,725,654	5,902,694	5,763,634	32	3.33
joinParty(address,uint256)	155,749	5,662,942	2,082,111	23	1.20
leaveParty(address,uint256,uint256)	176,059	200,199	181,366	5	0.10
setBNBPartySwapRouter(address)	24,180	46,320	44,843	15	0.03
setNonfungiblePositionManager(address,address)	27,399	68,928	66,159	15	0.04
setSwapRouter(address)	-	-	46,298	13	0.03
withdrawFee()	-	-	31,770	2	0.02
withdrawPartyLPFee(address[])	-	-	173,792	2	0.10
NonfungiblePositionManager
approve(address,uint256)	46,052	46,395	46,277	3	0.03
SwapRouter
exactInput((bytes,address,uint256,uint256,uint256))	133,979	143,537	140,351	3	0.08
multicall(bytes[])	-	-	160,560	2	0.09

Deployments

	Min	Max	Avg	Block %	usd avg
BNBPartyFactory	3,728,094	3,728,118	3,728,114	2.9 %	2.15
MockContract	-	-	107,817	0.1 %	0.06
MockNonfungibleTokenPositionDescriptor	-	-	111,537	0.1 %	0.06
NonfungiblePositionManager	5,171,512	5,171,524	5,171,518	4 %	2.99
SqrtPriceCalculator	-	-	278,712	0.2 %	0.16
SwapRouter	2,201,078	2,201,090	2,201,086	1.7 %	1.27
UniswapV3Factory	-	-	5,437,109	4.2 %	3.14

Solidity and Network Config

Settings	Value
Solidity: version	0.8.24
Solidity: optimized	true
Solidity: runs	200
Solidity: viaIR	false
Block Limit	130,000,000
L1 Gas Price	1 gwei
Token Price	577.76 usd/bnb
Network	BINANCE
Toolchain	hardhat

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 95.23810% with 2 lines in your changes missing coverage. Please review.

Files	Patch %	Lines
contracts/BNBPartyFee.sol	83.33%	2 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Files	Coverage Δ
contracts/BNBPartyCreation.sol	100.00% <100.00%> (ø)
contracts/BNBPartyFactory.sol	100.00% <100.00%> (ø)
contracts/BNBPartyLiquidity.sol	100.00% <100.00%> (ø)
contracts/BNBPartyLiquidityHelper.sol	100.00% <100.00%> (ø)
contracts/BNBPartyState.sol	62.50% <ø> (ø)
contracts/BNBPartyView.sol	90.90% <100.00%> (+8.55%)	⬆️
contracts/BNBPartyFee.sol	83.33% <83.33%> (ø)

[github-actions]

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• incorrect-equality (2 results) (Medium)
• reentrancy-no-eth (1 results) (Medium)
• unused-return (9 results) (Medium)
• shadowing-local (2 results) (Low)
• reentrancy-benign (4 results) (Low)
• reentrancy-events (5 results) (Low)
• assembly (1 results) (Informational)
• low-level-calls (6 results) (Informational)
• naming-convention (10 results) (Informational)
• reentrancy-unlimited-gas (1 results) (Informational)
• unused-import (3 results) (Informational)
• immutable-states (1 results) (Optimization)

incorrect-equality

Impact: Medium
Confidence: High

• ID-0
  BNBPartyCreation._calculateAmounts(address) uses a dangerous strict equality:
  • balanceA == party.initialTokenAmount

BNBParty.Factory/contracts/BNBPartyCreation.sol

Lines 83 to 90 in bd6f33e

	function _calculateAmounts(address tokenA) internal view returns (uint256 amount0, uint256 amount1) {
	uint256 balanceA = IERC20(tokenA).balanceOf(address(this));
	if (balanceA == party.initialTokenAmount) {
	amount0 = party.initialTokenAmount; // Set amount0 if tokenA balance matches the initial amount
	} else {
	amount1 = party.initialTokenAmount; // Otherwise, set amount1
	}
	}

• ID-1
  BNBPartyManageable.withdrawFee() uses a dangerous strict equality:
  • address(this).balance == 0

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 41 to 47 in bd6f33e

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance); // Transfers the entire BNB balance to the owner
	emit TransferOutBNB(msg.sender, address(this).balance); // Emits an event indicating the transfer of BNB
	}

reentrancy-no-eth

Impact: Medium
Confidence: Medium

• ID-2
  Reentrancy in BNBPartyLiquidity._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = _decreaseAndCollect(lpToTokenId[msg.sender],liquidity)
    • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:tokenId,liquidity:liquidity,amount0Min:0,amount1Min:0,deadline:block.timestamp}))
    • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:tokenId,recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • _approveTokens(token0,token1,amount0,amount1)
    • IERC20(token0).approve(address(positionManager),amount0)
    • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,newSqrtPriceX96,party.lpFee,party.lpTicks)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • _createLP(positionManager,token0,token1,amount0,amount1,newSqrtPriceX96,party.lpFee,party.lpTicks)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      BNBPartyState.lpToTokenId can be used in cross function reentrancies:
  • BNBPartyState.lpToTokenId

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 13 to 54 in bd6f33e

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	uint128 liquidity = pool.liquidity();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = _decreaseAndCollect(lpToTokenId[msg.sender], liquidity);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	uint160 newSqrtPriceX96;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount; // Deduct unwrap amount from token0 if it is WBNB
	isTokenOnPartyLP[token1] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount0RoundingUp(
	sqrtPriceX96,
	liquidity,
	unwrapAmount,
	false
	);
	} else {
	amount1 -= unwrapAmount; // Deduct unwrap amount from token1 if it is WBNB
	isTokenOnPartyLP[token0] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount1RoundingDown(
	sqrtPriceX96,
	liquidity,
	unwrapAmount / 2,
	false
	);
	}
	// Approve tokens for the new liquidity pool creation
	_approveTokens(token0, token1, amount0, amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, newSqrtPriceX96, party.lpFee, party.lpTicks);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	// burn meme tokens
	_burnMemeToken(token0 == address(WBNB) ? token1 : token0);
	}

unused-return

Impact: Medium
Confidence: Medium

• ID-3
  BNBPartyCreation._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24,IBNBPartyFactory.Ticks) ignores return value by (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyCreation.sol

Lines 43 to 77 in bd6f33e

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee,
	Ticks memory ticks
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: ticks.tickLower,
	tickUpper: ticks.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

• ID-4
  BNBPartyLiquidityHelper._decreaseAndCollect(uint256,uint128) ignores return value by BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:tokenId,recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))

BNBParty.Factory/contracts/BNBPartyLiquidityHelper.sol

Lines 16 to 40 in bd6f33e

	function _decreaseAndCollect(
	uint256 tokenId,
	uint128 liquidity
	) internal returns (uint256 amount0, uint256 amount1) {
	// Decrease liquidity from the position and receive the amount of token0 and token1
	(amount0, amount1) = BNBPositionManager.decreaseLiquidity(
	INonfungiblePositionManager.DecreaseLiquidityParams({
	tokenId: tokenId,
	liquidity: liquidity,
	amount0Min: 0, // Minimum amount of token0 to collect, set to 0 for flexibility
	amount1Min: 0, // Minimum amount of token1 to collect, set to 0 for flexibility
	deadline: block.timestamp // Deadline for the transaction to be completed
	})
	);
	// Collect the tokens from the position after liquidity decrease
	BNBPositionManager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: tokenId,
	recipient: address(this), // Collect tokens to this contract address
	amount0Max: uint128(amount0), // Maximum amount of token0 to collect
	amount1Max: uint128(amount1) // Maximum amount of token1 to collect
	})
	);
	}

• ID-5
  BNBPartyLiquidityHelper._approveTokens(address,address,uint256,uint256) ignores return value by IERC20(token0).approve(address(positionManager),amount0)

BNBParty.Factory/contracts/BNBPartyLiquidityHelper.sol

Lines 47 to 55 in bd6f33e

	function _approveTokens(
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1
	) internal {
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	}

• ID-6
  BNBPartyLiquidityHelper._approveTokens(address,address,uint256,uint256) ignores return value by IERC20(token1).approve(address(positionManager),amount1)

BNBParty.Factory/contracts/BNBPartyLiquidityHelper.sol

Lines 47 to 55 in bd6f33e

	function _approveTokens(
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1
	) internal {
	IERC20(token0).approve(address(positionManager), amount0);
	IERC20(token1).approve(address(positionManager), amount1);
	}

• ID-7
  BNBPartyManageable._collectFee(address,INonfungiblePositionManager) ignores return value by manager.collect(INonfungiblePositionManager.CollectParams({tokenId:lpToTokenId[liquidityPool],recipient:msg.sender,amount0Max:type()(uint128).max,amount1Max:type()(uint128).max}))

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 83 to 95 in bd6f33e

	function _collectFee(
	address liquidityPool,
	INonfungiblePositionManager manager
	) internal notZeroAddress(liquidityPool) {
	manager.collect(
	INonfungiblePositionManager.CollectParams({
	tokenId: lpToTokenId[liquidityPool],
	recipient: msg.sender,
	amount0Max: type(uint128).max,
	amount1Max: type(uint128).max
	})
	); // Collects fees from the specified liquidity pool
	}

• ID-8
  BNBPartySwaps._executeSwap(ISwapRouter,ISwapRouter.ExactInputParams) ignores return value by ISwapRouter(router).exactInput{value: value}(params)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 50 to 56 in bd6f33e

	function _executeSwap(
	ISwapRouter router,
	ISwapRouter.ExactInputParams memory params
	) internal notZeroAddress(address(router)) {
	uint256 value = msg.value > 0 ? params.amountIn : 0; // Set value if msg.value is greater than zero
	ISwapRouter(router).exactInput{value: value}(params); // Executes the swap
	}

• ID-9
  BNBPartyCreation._createFLP(address) ignores return value by IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)

BNBParty.Factory/contracts/BNBPartyCreation.sol

Lines 14 to 31 in bd6f33e

	function _createFLP(address _token) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	// Determine the token amounts
	(uint256 amount0, uint256 amount1) = _calculateAmounts(tokenA);
	IERC20(_token).approve(address(BNBPositionManager), party.initialTokenAmount);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee,
	party.partyTicks
	);
	isParty[liquidityPool] = true; // Mark the liquidity pool as a party pool
	isTokenOnPartyLP[_token] = true; // Mark the token as part of the party LP
	}

• ID-10
  BNBPartyFee._getFeeGrowthInsideLastX128(IUniswapV3Pool,bytes32) ignores return value by (None,feeGrowthInside0LastX128,feeGrowthInside1LastX128,None,None) = pool.positions(key)

BNBParty.Factory/contracts/BNBPartyFee.sol

Lines 67 to 79 in bd6f33e

	function _getFeeGrowthInsideLastX128(
	IUniswapV3Pool pool,
	bytes32 key
	)
	internal
	view
	returns (
	uint256 feeGrowthInside0LastX128,
	uint256 feeGrowthInside1LastX128
	)
	{
	(, feeGrowthInside0LastX128, feeGrowthInside1LastX128, , ) = pool.positions(key);
	}

• ID-11
  BNBPartyLiquidity._handleLiquidity(address) ignores return value by (sqrtPriceX96,None,None,None,None,None,None) = pool.slot0()

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 13 to 54 in bd6f33e

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	uint128 liquidity = pool.liquidity();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = _decreaseAndCollect(lpToTokenId[msg.sender], liquidity);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	uint160 newSqrtPriceX96;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount; // Deduct unwrap amount from token0 if it is WBNB
	isTokenOnPartyLP[token1] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount0RoundingUp(
	sqrtPriceX96,
	liquidity,
	unwrapAmount,
	false
	);
	} else {
	amount1 -= unwrapAmount; // Deduct unwrap amount from token1 if it is WBNB
	isTokenOnPartyLP[token0] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount1RoundingDown(
	sqrtPriceX96,
	liquidity,
	unwrapAmount / 2,
	false
	);
	}
	// Approve tokens for the new liquidity pool creation
	_approveTokens(token0, token1, amount0, amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, newSqrtPriceX96, party.lpFee, party.lpTicks);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	// burn meme tokens
	_burnMemeToken(token0 == address(WBNB) ? token1 : token0);
	}

shadowing-local

Impact: Low
Confidence: High

• ID-12
  ERC20Token.constructor(string,string,uint256).name shadows:
  • ERC20.name() (function)
  • IERC20Metadata.name() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 16 in bd6f33e

string memory name,

• ID-13
  ERC20Token.constructor(string,string,uint256).symbol shadows:
  • ERC20.symbol() (function)
  • IERC20Metadata.symbol() (function)

BNBParty.Factory/contracts/token/ERC20Token.sol

Line 17 in bd6f33e

string memory symbol,

reentrancy-benign

Impact: Low
Confidence: Medium

• ID-14
  Reentrancy in BNBPartyFactory.createParty(string,string):
  External calls:
  • liquidityPool = _createFLP(address(newToken))
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
      State variables written after the call(s):
  • lpToCreator[liquidityPool] = msg.sender

BNBParty.Factory/contracts/BNBPartyFactory.sol

Lines 32 to 53 in bd6f33e

	function createParty(
	string calldata name,
	string calldata symbol
	)
	external
	payable
	override
	nonReentrant
	insufficientBNB
	notZeroAddress(address(BNBPositionManager))
	returns (IERC20 newToken)
	{
	// Create new token
	newToken = new ERC20Token(name, symbol, party.initialTokenAmount);
	// Create First Liquidity Pool
	address liquidityPool = _createFLP(address(newToken));
	lpToCreator[liquidityPool] = msg.sender;
	if (msg.value > party.createTokenFee) {
	_executeSwap(address(newToken));
	}
	emit StartParty(address(newToken), msg.sender, liquidityPool);
	}

• ID-15
  Reentrancy in BNBPartyCreation._createLP(INonfungiblePositionManager,address,address,uint256,uint256,uint160,uint24,IBNBPartyFactory.Ticks):
  External calls:
  • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
    State variables written after the call(s):
  • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyCreation.sol

Lines 43 to 77 in bd6f33e

	function _createLP(
	INonfungiblePositionManager liquidityManager,
	address token0,
	address token1,
	uint256 amount0,
	uint256 amount1,
	uint160 sqrtPriceX96,
	uint24 fee,
	Ticks memory ticks
	) internal returns (address liquidityPool) {
	// Create LP
	liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(
	token0,
	token1,
	fee,
	sqrtPriceX96
	);
	// Mint LP
	(lpToTokenId[liquidityPool], , , ) = liquidityManager.mint(
	INonfungiblePositionManager.MintParams({
	token0: token0,
	token1: token1,
	fee: fee,
	tickLower: ticks.tickLower,
	tickUpper: ticks.tickUpper,
	amount0Desired: amount0,
	amount1Desired: amount1,
	amount0Min: 0,
	amount1Min: 0,
	recipient: address(this),
	deadline: block.timestamp
	})
	);
	}

• ID-16
  Reentrancy in BNBPartyLiquidity._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = _decreaseAndCollect(lpToTokenId[msg.sender],liquidity)
    • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:tokenId,liquidity:liquidity,amount0Min:0,amount1Min:0,deadline:block.timestamp}))
    • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:tokenId,recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
      State variables written after the call(s):
  • isTokenOnPartyLP[token1] = false
  • isTokenOnPartyLP[token0] = false

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 13 to 54 in bd6f33e

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	uint128 liquidity = pool.liquidity();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = _decreaseAndCollect(lpToTokenId[msg.sender], liquidity);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	uint160 newSqrtPriceX96;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount; // Deduct unwrap amount from token0 if it is WBNB
	isTokenOnPartyLP[token1] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount0RoundingUp(
	sqrtPriceX96,
	liquidity,
	unwrapAmount,
	false
	);
	} else {
	amount1 -= unwrapAmount; // Deduct unwrap amount from token1 if it is WBNB
	isTokenOnPartyLP[token0] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount1RoundingDown(
	sqrtPriceX96,
	liquidity,
	unwrapAmount / 2,
	false
	);
	}
	// Approve tokens for the new liquidity pool creation
	_approveTokens(token0, token1, amount0, amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, newSqrtPriceX96, party.lpFee, party.lpTicks);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	// burn meme tokens
	_burnMemeToken(token0 == address(WBNB) ? token1 : token0);
	}

• ID-17
  Reentrancy in BNBPartyCreation._createFLP(address):
  External calls:
  • IERC20(_token).approve(address(BNBPositionManager),party.initialTokenAmount)
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee,party.partyTicks)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
      State variables written after the call(s):
  • isParty[liquidityPool] = true
  • isTokenOnPartyLP[_token] = true
  • liquidityPool = _createLP(BNBPositionManager,tokenA,tokenB,amount0,amount1,sqrtPrice,party.partyLpFee,party.partyTicks)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))

BNBParty.Factory/contracts/BNBPartyCreation.sol

Lines 14 to 31 in bd6f33e

	function _createFLP(address _token) internal returns (address liquidityPool) {
	(address tokenA, address tokenB, uint160 sqrtPrice) = _getTokenPairAndPrice(_token);
	// Determine the token amounts
	(uint256 amount0, uint256 amount1) = _calculateAmounts(tokenA);
	IERC20(_token).approve(address(BNBPositionManager), party.initialTokenAmount);
	liquidityPool = _createLP(
	BNBPositionManager,
	tokenA,
	tokenB,
	amount0,
	amount1,
	sqrtPrice,
	party.partyLpFee,
	party.partyTicks
	);
	isParty[liquidityPool] = true; // Mark the liquidity pool as a party pool
	isTokenOnPartyLP[_token] = true; // Mark the token as part of the party LP
	}

reentrancy-events

Impact: Low
Confidence: Medium

• ID-18
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
  • _transferBNB(creator,party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(creator,party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 13 to 22 in bd6f33e

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount); // Unwrap WBNB to BNB
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator); // Send total bonus to creator
	} else {
	_transferBNB(recipient, party.bonusTargetReach); // Send bonus to recipient
	_transferBNB(creator, party.bonusPartyCreator); // Send bonus to creator
	}
	}

• ID-19
  Reentrancy in BNBPartySwaps._transferBNB(address,uint256):
  External calls:
  • (success,None) = recipient.call{value: amount}()
    Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 28 to 34 in bd6f33e

	function _transferBNB(address recipient, uint256 amount) private {
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-20
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach + party.bonusPartyCreator)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 13 to 22 in bd6f33e

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount); // Unwrap WBNB to BNB
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator); // Send total bonus to creator
	} else {
	_transferBNB(recipient, party.bonusTargetReach); // Send bonus to recipient
	_transferBNB(creator, party.bonusPartyCreator); // Send bonus to creator
	}
	}

• ID-21
  Reentrancy in BNBPartyLiquidity._handleLiquidity(address):
  External calls:
  • (amount0,amount1) = _decreaseAndCollect(lpToTokenId[msg.sender],liquidity)
    • (amount0,amount1) = BNBPositionManager.decreaseLiquidity(INonfungiblePositionManager.DecreaseLiquidityParams({tokenId:tokenId,liquidity:liquidity,amount0Min:0,amount1Min:0,deadline:block.timestamp}))
    • BNBPositionManager.collect(INonfungiblePositionManager.CollectParams({tokenId:tokenId,recipient:address(this),amount0Max:uint128(amount0),amount1Max:uint128(amount1)}))
  • _approveTokens(token0,token1,amount0,amount1)
    • IERC20(token0).approve(address(positionManager),amount0)
    • IERC20(token1).approve(address(positionManager),amount1)
  • _createLP(positionManager,token0,token1,amount0,amount1,newSqrtPriceX96,party.lpFee,party.lpTicks)
    • liquidityPool = liquidityManager.createAndInitializePoolIfNecessary(token0,token1,fee,sqrtPriceX96)
    • (lpToTokenId[liquidityPool],None,None,None) = liquidityManager.mint(INonfungiblePositionManager.MintParams({token0:token0,token1:token1,fee:fee,tickLower:ticks.tickLower,tickUpper:ticks.tickUpper,amount0Desired:amount0,amount1Desired:amount1,amount0Min:0,amount1Min:0,recipient:address(this),deadline:block.timestamp}))
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • WBNB.withdraw(unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _unwrapAndSendBNB(recipient,unwrapAmount)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _unwrapAndSendBNB(recipient,unwrapAmount)

BNBParty.Factory/contracts/BNBPartyLiquidity.sol

Lines 13 to 54 in bd6f33e

	function _handleLiquidity(address recipient) internal {
	IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
	(uint160 sqrtPriceX96, , , , , , ) = pool.slot0();
	address token0 = pool.token0();
	address token1 = pool.token1();
	uint128 liquidity = pool.liquidity();
	// Decrease liquidity and collect tokens
	(uint256 amount0, uint256 amount1) = _decreaseAndCollect(lpToTokenId[msg.sender], liquidity);
	uint256 unwrapAmount = party.bonusTargetReach + party.bonusPartyCreator + party.targetReachFee;
	uint160 newSqrtPriceX96;
	if (token0 == address(WBNB)) {
	amount0 -= unwrapAmount; // Deduct unwrap amount from token0 if it is WBNB
	isTokenOnPartyLP[token1] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount0RoundingUp(
	sqrtPriceX96,
	liquidity,
	unwrapAmount,
	false
	);
	} else {
	amount1 -= unwrapAmount; // Deduct unwrap amount from token1 if it is WBNB
	isTokenOnPartyLP[token0] = false;
	newSqrtPriceX96 = sqrtPriceCalculator.getNextSqrtPriceFromAmount1RoundingDown(
	sqrtPriceX96,
	liquidity,
	unwrapAmount / 2,
	false
	);
	}
	// Approve tokens for the new liquidity pool creation
	_approveTokens(token0, token1, amount0, amount1);
	// Create new Liquidity Pool
	_createLP(positionManager, token0, token1, amount0, amount1, newSqrtPriceX96, party.lpFee, party.lpTicks);
	// Send bonuses
	_unwrapAndSendBNB(recipient, unwrapAmount);
	// burn meme tokens
	_burnMemeToken(token0 == address(WBNB) ? token1 : token0);
	}

• ID-22
  Reentrancy in BNBPartySwaps._unwrapAndSendBNB(address,uint256):
  External calls:
  • WBNB.withdraw(unwrapAmount)
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      External calls sending eth:
  • _transferBNB(recipient,party.bonusTargetReach)
    • (success,None) = recipient.call{value: amount}()
      Event emitted after the call(s):
  • TransferOutBNB(recipient,amount)
    • _transferBNB(recipient,party.bonusTargetReach)

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 13 to 22 in bd6f33e

	function _unwrapAndSendBNB(address recipient, uint256 unwrapAmount) internal {
	address creator = lpToCreator[msg.sender];
	WBNB.withdraw(unwrapAmount); // Unwrap WBNB to BNB
	if (recipient == creator) {
	_transferBNB(recipient, party.bonusTargetReach + party.bonusPartyCreator); // Send total bonus to creator
	} else {
	_transferBNB(recipient, party.bonusTargetReach); // Send bonus to recipient
	_transferBNB(creator, party.bonusPartyCreator); // Send bonus to creator
	}
	}

assembly

Impact: Informational
Confidence: High

• ID-23
  Address._revert(bytes) uses assembly
  • INLINE ASM

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/utils/Address.sol#L146-L158

low-level-calls

Impact: Informational
Confidence: High

• ID-24
  Low level call in SafeERC20._callOptionalReturnBool(IERC20,bytes):
  • (success,returndata) = address(token).call(data)

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#L110-L117

• ID-25
  Low level call in Address.functionStaticCall(address,bytes):
  • (success,returndata) = target.staticcall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/utils/Address.sol#L95-L98

• ID-26
  Low level call in Address.functionDelegateCall(address,bytes):
  • (success,returndata) = target.delegatecall(data)

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/utils/Address.sol#L104-L107

• ID-27
  Low level call in BNBPartySwaps._transferBNB(address,uint256):
  • (success,None) = recipient.call{value: amount}()

BNBParty.Factory/contracts/BNBPartySwaps.sol

Lines 28 to 34 in bd6f33e

	function _transferBNB(address recipient, uint256 amount) private {
	(bool success, ) = recipient.call{value: amount}("");
	if (!success) {
	revert BonusAmountTransferFailed();
	}
	emit TransferOutBNB(recipient, amount);
	}

• ID-28
  Low level call in Address.sendValue(address,uint256):
  • (success,None) = recipient.call{value: amount}()

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/utils/Address.sol#L41-L50

• ID-29
  Low level call in Address.functionCallWithValue(address,bytes,uint256):
  • (success,returndata) = target.call{value: value}(data)

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/utils/Address.sol#L83-L89

naming-convention

Impact: Informational
Confidence: High

• ID-30
  Variable BNBPartyState.WBNB is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 28 in bd6f33e

IWBNB public immutable WBNB; // Wrapped BNB token contract

• ID-31
  Variable BNBPartyState.BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 15 in bd6f33e

INonfungiblePositionManager public BNBPositionManager; // BNB Party position manager

• ID-32
  Parameter BNBPartyManageable.setSwapRouter(ISwapRouter)._swapRouter is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 34 in bd6f33e

ISwapRouter _swapRouter

• ID-33
  Parameter BNBPartyManageable.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._BNBPositionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 14 in bd6f33e

INonfungiblePositionManager _BNBPositionManager,

• ID-34
  Function INonfungiblePositionManager.WETH9() is not in mixedCase

BNBParty.Factory/contracts/interfaces/INonfungiblePositionManager.sol

Line 184 in bd6f33e

function WETH9() external view returns (address);

• ID-35
  Parameter BNBPartyManageable.setNonfungiblePositionManager(INonfungiblePositionManager,INonfungiblePositionManager)._positionManager is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 15 in bd6f33e

INonfungiblePositionManager _positionManager

• ID-36
  Function IERC20Permit.DOMAIN_SEPARATOR() is not in mixedCase

https://github.com/bnb-party/BNBParty.Factory/blob/bd6f33ecf2629d17c385f8420d11fc83c36c0aaa/node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Permit.sol#L89

• ID-37
  Parameter BNBPartyManageable.setBNBPartySwapRouter(ISwapRouter)._swapRouter is not in mixedCase

BNBParty.Factory/contracts/BNBPartyManageable.sol

Line 28 in bd6f33e

ISwapRouter _swapRouter

• ID-38
  Modifier BNBPartyModifiers.SwapRouterAlreadySet(ISwapRouter,ISwapRouter) is not in mixedCase

BNBParty.Factory/contracts/BNBPartyModifiers.sol

Lines 46 to 54 in bd6f33e

	modifier SwapRouterAlreadySet(
	ISwapRouter _swapRouter,
	ISwapRouter _newSwapRouter
	) {
	if (_swapRouter == _newSwapRouter) {
	revert AlreadySet();
	}
	_;
	}

• ID-39
  Variable BNBPartyState.BNBSwapRouter is not in mixedCase

BNBParty.Factory/contracts/BNBPartyState.sol

Line 17 in bd6f33e

ISwapRouter public BNBSwapRouter; // V3 swap router

reentrancy-unlimited-gas

Impact: Informational
Confidence: Medium

• ID-40
  Reentrancy in BNBPartyManageable.withdrawFee():
  External calls:
  • address(msg.sender).transfer(address(this).balance)
    Event emitted after the call(s):
  • TransferOutBNB(msg.sender,address(this).balance)

BNBParty.Factory/contracts/BNBPartyManageable.sol

Lines 41 to 47 in bd6f33e

	function withdrawFee() external onlyOwner {
	if (address(this).balance == 0) {
	revert ZeroAmount();
	}
	payable(msg.sender).transfer(address(this).balance); // Transfers the entire BNB balance to the owner
	emit TransferOutBNB(msg.sender, address(this).balance); // Emits an event indicating the transfer of BNB
	}

unused-import

Impact: Informational
Confidence: High

• ID-41
  The following unused import(s) in contracts/BNBPartyState.sol should be removed:
  -import "./interfaces/IUniswapV3Pool.sol"; (contracts/BNBPartyState.sol#9)

• ID-42
  The following unused import(s) in contracts/BNBPartyLiquidity.sol should be removed:
  -import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol"; (contracts/BNBPartyLiquidity.sol#5)

• ID-43
  The following unused import(s) in contracts/BNBPartyCreation.sol should be removed:
  -import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol"; (contracts/BNBPartyCreation.sol#5)

immutable-states

Impact: Optimization
Confidence: High

• ID-44
  BNBPartyState.sqrtPriceCalculator should be immutable

BNBParty.Factory/contracts/BNBPartyState.sol

Line 23 in bd6f33e

ISqrtPriceCalculator public sqrtPriceCalculator;