Team and KYC Verification
The KYC verification for this project is currently in progress.
The team has submitted their information and verification is pending.
TrustNet Score
The TrustNet Score evaluates crypto projects based on audit results, security, KYC verification, and social media presence. This score offers a quick, transparent view of a project's credibility, helping users make informed decisions in the Web3 space.
Real-Time Threat Detection
Real-time threat detection, powered by Cyvers.io,
is currently not
activated
for this project.
This advanced feature provides continuous monitoring and instant alerts to safeguard your assets from potential security threats. Real-time detection enhances your project's security by proactively identifying and mitigating risks.
For more information, click here.
Summary and Final Words
No crucial issues found
The contract does not contain issues of high or medium criticality. This means that no known vulnerabilities were found in the source code.
Contract owner cannot mint
It is not possible to mint new tokens.
Contract owner cannot blacklist addresses.
It is not possible to lock user funds by blacklisting addresses.
Contract owner can set high fees
Contract owner is able to set fees above 25%. Very high fees can also prevent token transfer.
Token transfer can be locked
Owner can lock user funds with owner functions.
Token cannot be burned
There is no burning within the contract without any allowances
Ownership is not renounced
The owner retains significant control, which could potentially be used to modify key contract parameters.
Contract is not upgradeable
The contract does not use proxy patterns or other mechanisms to allow future upgrades. Its behavior is locked in its current state.
Scope of Work
This audit encompasses the evaluation of the files listed below, each verified with a SHA-1 Hash. The team referenced above has provided the necessary files for assessment.
The auditing process consists of the following systematic steps:
- Specification Review: Analyze the provided specifications, source code, and instructions to fully understand the smart contract's size, scope, and functionality.
- Manual Code Examination: Conduct a thorough line-by-line review of the source code to identify potential vulnerabilities and areas for improvement.
- Specification Alignment: Ensure that the code accurately implements the provided specifications and intended functionalities.
- Test Coverage Assessment: Evaluate the extent and effectiveness of test cases in covering the codebase, identifying any gaps in testing.
- Symbolic Execution: Analyze the smart contract to determine how various inputs affect execution paths, identifying potential edge cases and vulnerabilities.
- Best Practices Evaluation: Assess the smart contracts against established industry and academic best practices to enhance efficiency, maintainability, and security.
- Actionable Recommendations: Provide detailed, specific, and actionable steps to secure and optimize the smart contracts.
A file with a different Hash has been intentionally or otherwise modified after the security review. A different Hash may indicate a changed condition or potential vulnerability that was not within the scope of this review.
Final Words
The following provides a concise summary of the audit report, accompanied by insightful comments from the auditor. This overview captures the key findings and observations, offering valuable context and clarity.
Ownership Privileges
- The owner or deployer can set the marketing, treasury wallet address.
- The owner can pause/unpause the trading.
- The owner can disable the launch protection.
- The owner or deployer can manually trigger a swap of tokens to ETH.
- The owner or deployer can recover ERC20 tokens from the contract.
- The owner or deployer can withdraw ETH from the contract.
- The owner or deployer can set the token accumulation probability and range.
- The owner or deployer can enable or disable the automated token swap.
- The deployer can use an emergency pause on trading.
- The deployer can set an override for the buy and sell fees.
- The deployer can set the sell limit.
- The deployer can exclude an address from fees and limits.
- The deployer can force a distribution of the contract's tokens.
- The deployer can manually set the ETH amount raised.
- The deployer can perform an emergency transfer of tokens from the contract.
Note - This Audit report consists of a security analysis of the AcoreAI smart contract. This analysis did not include functional testing (or unit testing) of the contract’s logic. Moreover, we only audited one token contract for the AcoreAI team. Other contracts associated with the project were not audited by our team. We recommend investors do their own research before investing.
Files and details
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Functions
public
/
State variables
public
/
Total lines
of code
/
Capabilities
Hover on items
/
Findings and Audit result
high Issues | 1 findings
Pending
#1 high Issue
The owner can lock trading
The smart contract contains two functions, setPaused() and emergencyPause(), that present a significant centralization risk. The setPaused() function can be called by either the contract owner or a hardcoded DEPLOYER_WALLET, while the emergencyPause() function can be called exclusively by the DEPLOYER_WALLET. Both functions can set the tradingPaused flag to true, which effectively halts all token transfers indefinitely, as checked in the _transfer function. This gives these two addresses complete control over the liquidity and tradability of the token, allowing them to freeze all user assets at will.
medium Issues | 6 findings
Pending
#1 medium Issue
Missing 'require' check. (Potential honeypot)
The owner can set any arbitrary address to the marketing wallet and treasury wallet address, excluding zero address, as this can lead to a potential honeypot if the owner has set the address to a contract address that cannot receive ETH. It is recommended that the address cannot be set to a contract address that cannot receive ETH to avoid these circumstances.
Pending
#2 medium Issue
Deployer Control Over Dynamic Fees
The setRaiseAmount function presents a significant centralization risk, allowing the deployer to unilaterally manipulate the dynamic transaction fees. The contract is designed to automatically lower fees from 4% to 0% as ETH fundraising milestones are met. However, this function lets the deployer arbitrarily change the raiseAmount variable, which controls these fee tiers. The deployer could unfairly reset fees to the maximum 4% even after targets are met, or prematurely eliminate fees by setting the amount high. This undermines the predictability and fairness of the token's economic model, giving the deployer arbitrary control over the fee structure instead of letting it be driven by actual fundraising performance.
Pending
#3 medium Issue
Flawed Accumulation Logic and Predictable Randomness
The _handleAccumulation function contains a critical logic flaw that renders its primary feature non-functional. The function is intended to "subtly accumulate" a small, random portion of fee tokens by withholding them from being swapped for ETH. However, due to a bug in the code, the contract always swaps the entire fee amount, even when it randomly decides to "accumulate." An event is emitted suggesting tokens were retained, but they are sold immediately. This bug is compounded by the use of predictable on-chain data (like block.timestamp and msg.sender) for its random number generation. This predictability would allow sophisticated bots to anticipate the function's behavior, but more importantly, it exposes the underlying flaw: the "subtle accumulation" system is entirely non-operational and misleading.
Pending
#4 medium Issue
Faulty ETH Received Calculation Inflates Fundraising Total
The _swapTokensForETH function incorrectly calculates the amount of ETH received from a Uniswap trade. It measures the contract's entire ETH balance after the swap and assumes that total is the amount received. This creates a critical accounting bug if a previous ETH distribution failed, leaving a residual ETH balance in the contract. For example: imagine the contract receives 1 ETH, but only successfully sends out 0.5 ETH, leaving 0.5 ETH stuck. On the next swap, it receives another 1 ETH. The contract's balance is now 1.5 ETH, and the function incorrectly records this entire amount as newly received funds. This inflates the raiseAmount, causing the dynamic fee system to lower fees prematurely based on misleading fundraising totals.
Pending
#5 medium Issue
Deployer Can Unilaterally Set Exorbitant Transaction Fees
The setFeeOverride function grants the DEPLOYER_WALLET the extreme power to unilaterally set buy and sell fees as high as 50%. This function bypasses all other fee mechanisms in the contract, including the automated launch and dynamic fee schedules. A malicious or compromised deployer could abuse this function to effectively trap user funds by setting sell fees to an unsustainable level, making it impossible for holders to sell their tokens without incurring massive losses. This represents a severe centralization risk, as it gives one address complete and immediate control over the token's trading viability, undermining trust in the project's economic rules.
Pending
#6 medium Issue
Missing Non-reentrant check.
The contract contains a re-entrancy vulnerability that stems from a violation of the Checks-Effects-Interactions security pattern within the _checkPeriodicSwap function. This function, called at the end of every _transfer, executes an external call via _swapTokensForETH before it updates its own state by setting the lastSwapTime. This incorrect ordering creates a window for attack. An attacker who compromises the owner's account can set the marketingWallet to a malicious contract. When that contract receives ETH from a swap, it can immediately call transfer() again, re-entering the function. Because lastSwapTime has not been updated, the checks pass again, allowing the swap to be re-triggered repeatedly within a single transaction to drain all swappable tokens.