Crypto All Stars

AUDIT
SECURITY ASSESSMENT

12. August, 2024
FOR

1

SolidProof_io@solidproof_ioIntroduction

3

Disclaimer

3

Project Overview

4

Summary

4

Social Medias

4

Audit Summary

5File Overview

6

Imported packages

6

Components

7

Exposed Functions

7

Capabilities

8

Inheritance Graph

9

Audit Information

10

Vulnerability & Risk Level

10

Auditing Strategy and Techniques Applied

11

Methodology

11

Overall Security

12

Upgradeability

12

Ownership

13

Ownership Privileges

14

Minting tokens

14

Burning tokens

15Blacklist addresses

16

Fees and Tax

17

Lock User Funds

18

Centralization PrivilegesAudit Results

19202Introduction
SolidProof.io is a brand of the officially registered company
FutureVisions Deutschland, based in Germany. We’re mainly focusedon Blockchain Security such as Smart Contract Audits and KYC
verification for project teams.
Solidproof.io assess potential security issues in the smart contracts
implementations, review for potential inconsistencies between thecode base and the whitepaper/documentation, and provide
suggestions for improvement.

Disclaimer
SolidProof.io reports are not, nor should be considered, an“endorsement”or “disapproval” of any particular project or team. These
reports are not, nor should be considered, an indication of theeconomics or value of any “product” or “asset” created by any team.
SolidProof.io do not cover testing or auditing the integration withexternal contract or services (such as Unicrypt, Uniswap, PancakeSwapetc’...)
SolidProof.io Audits do not provide any warranty or guarantee
regarding the absolute bug-free nature of the technology analyzed,
nor do they provide any indication of the technology proprietors.
SolidProof Audits should not be used in any way to make decisions
around investment or involvement with any particular project. These
reports in no way provide investment advice, nor should be leveraged
as investment advice of any sort.
SolidProof.io Reports represent an extensive auditing processintending to help our customers increase the quality of their code
while reducing the high level of risk presented by cryptographic
tokens and blockchain technology. Blockchain technology andcryptographic assets present a high level of ongoing risk. SolidProof’s
position is that each company and individual are responsible for theirown due diligence and continuous security. SolidProof in no way
claims any guarantee of the security or functionality of thetechnology we agree to analyze.

3Project Overview
SummaryProject Name

Crypto All Stars

Websitehttps://cryptoallstars.io/

About the project

Welcome to Crypto All-Stars ($STARS) – the gamechanging token set to redefine the meme coin space!
We’ve assembled the crème de la crème of meme coins
into a single, powerful token and platform. Now, every
crypto whale in the world is under one roof and canstake ALL top meme tokens and reap rewards in$STARS.

Chain

Ethereum

Language

Solidity

Codebasehttps://etherscan.io/address/0x04F121600c8C47A754636f
c9d75661a9525e05D5

CommitN/AUnit Tests

Not Provided

Social Medias
Telegramhttps://t.me/Crypto_allstars

Twitter

https://x.com/all_stars_coin

Facebook

N/A

Instagram

N/A

GitHub

N/A

RedditN/A

MediumN/A

Discord

N/A

YouTubeN/A

TikTokN/A

LinkedIn

N/A

4

Audit Summary
VersionDelivery Date

v1.0

12. August 2024

Change Log•Layout Project•

Automated/ Manual-Security Testing•

Summary

Note – The following audit report presents a comprehensive securityanalysis of the smart contract utilized in the project that includes
outside manipulation of the contract’s functions in a malicious way.
This analysis did not include functional testing (or unit testing) of thecontract/s logic. We cannot guarantee 100% logical correctness of thecontract as we did not functionally test it. This includes internal
calculations in the formulae used in the contract.

5File Overview
The Team provided us with the files that should be tested in thesecurity assessment. This audit covered the following files listed below
with an SHA-1 Hash.
File Name

SHA-1 Hash

contracts/Token.sol

2cad1bfef719df90cad15c51c907f53d5e138ca6

Please note: Files with a different hash value than in this table have been modified
after the security check, either intentionally or unintentionally. A different hashvalue may (but need not) be an indication of a changed state or potential
vulnerability that was not the subject of this scan.

Imported packages.
Used code from other Frameworks/Smart Contracts.
N/A
Note for Investors: We only audited contracts mentioned in the scopeabove. All contracts related to the project apart from that are not a part of
the audit, and we cannot comment on its security and are not responsiblefor it in any way.

6

External/Public functions

External/public functions are functions that can be called from outside of a contract,i.e., they can be accessed by other contracts or external accounts on the blockchain.

These functions are specified using the function declaration’s external or public
visibility modifier.

State variables
State variables are variables that are stored on the blockchain as part of thecontract'sstate. They are declared at the contract level and can be accessed

and modified by any function within the contract. State variables canbe needed within visibility modifier, such as public, private or internal,
which determines the access level of the variable.

Components
Contracts

Libraries

10Interfaces
2Abstract
2Exposed Functions

This section lists functions that are explicitly declared public or payable.
Please note that getter methods for public stateVars are not included.
PublicPayable240

External

Internal

Private

Pure

View

1026

0016

StateVariables
Total
12

Public57

Capabilities
SolidityVersions
observed
0.8.9

ExperimentalFeatures----------Can
ReceiveFunds

🖥 UsesAssemblyHas
DestroyableContracts----------

8

Inheritance Graph
An inheritance graph is a graphical representation of the inheritance hierarchy
among contracts. In object-oriented programming, inheritance is a mechanismthat allows one class (or contract, in the case of Solidity) to inherit properties andmethodsfrom another class. It shows the relationships between different contracts
and how they are related to each other through inheritance.

9

Audit Information
Vulnerability & Risk Level
Risk represents the probability that a certain source threat will exploit
the vulnerability and the impact of that event on the organization orsystem.The risk level is computed based on CVSS version 3.0.
Level

CriticalHighMediumLow

InformationalValue

Vulnerability

Risk (Required Action)

9 - 10A vulnerability that can disrupt thecontract functioning in a numberof scenarios, or creates a risk thatthe contract may be broken.

Immediate action toreduce risk level.

A vulnerability that affects thedesired outcome when using acontract, or provides theopportunity to use a contract in an
unintended way.

Implementation ofcorrective actions assoon aspossible.

7 – 8.9

4 – 6.9

2 – 3.9

0 – 1.9

A vulnerability that could affectthe desired outcome of
executingthe contract in aspecific scenario.

Implementation ofcorrective actions in acertain period.

A vulnerability that does not havea significant impact on possible
scenarios for the use of thecontract and is probablysubjective.

Implementation ofcertain corrective
actions or accepting
the risk.

A vulnerability that haveinformational character but is noteffecting any of the code.

An observation that
does not determine alevel of risk

10

Auditing Strategy and Techniques AppliedThroughout the review process, care was taken to check the repository
for security-related issues, code quality, and compliance withspecifications and best practices. To this end, our team of experienced
pen-testers and smart contract developers reviewed the code line byline and documented any issues discovered.
We check every file manually. We use automated tools only so thatthey help us achieve faster and better results.

Methodology
The auditing process follows a routine series of steps:
1.

Code review that includes the following:a. Reviewing the specifications, sources, and instructions
provided toSolidProof to ensure we understand the size, scope, andfunctionality of thesmart contract.
b. Manual review of the code, i.e., reading the source code line
by line to identify potential vulnerabilities.
c. Comparison to the specification, i.e., verifying that the code
does what is described in the specifications, sources, andinstructions provided to SolidProof.

2.

Testing and automated analysis that includes the following:a. Test coverage analysis determines whether test cases covercode and how much code is executed when those test cases
are executed.
b. Symbolic execution, which is analysing a program todetermine what inputs cause each part of a program toexecute.

3.

Review best practices, i.e., review smart contracts to improve efficiency,
effectiveness, clarity, maintainability, security, and control based onbest practices, recommendations, and research from industry andacademia.

4.

Concrete, itemized and actionable recommendations to help you
secure your smart contracts.

11Overall Security
Upgradeability

Deployer cannot update the contract
with new functionalities.

Contract is not an upgradable
Description

The contract is not an upgradeable contract. TheDeployer is not able to change or add any
functionalities to the contract after deploying.

Comment

N/A

12

Ownership
Theownership
isContract
ownership
isrenounced.
renounced.

The ownership is renounced.

Description

There are no ownership privileges in this contract.

Comment

N/A

Note – The contract cannot be considered as renounced till it is not deployedor having some functionality that can change the state of the contract.

13

Ownership Privileges

These functions can be dangerous. Please note that abuse can lead to financial loss.
We have a guide where you can learn more about these Functions.

Minting tokens
Minting tokens refer to the process of creating new tokens in a cryptocurrency or
blockchain network. This process is typically performed by the project's owner ordesignated authority, who has the ability to add new tokens to the network's total
supply.

Description

The owner is not able to mint new tokens oncethe contract is deployed.

CommentN/A14

Burning tokens
Burning tokens is the process of permanently destroying a certain number oftokens, reducing the total supply of a cryptocurrency or token. This is usually done
to increase the value of the remaining tokens, as the reduced supply can create
scarcity and potentially drive up demand.
Contract owner cannot
burn tokens

The owner cannot burn tokens.

Description

The owner is not able burn tokens without
any allowances.

CommentN/A15

Blacklist addresses
Blacklisting addresses in smart contracts is the process of adding
a certain address to a blacklist, effectively preventing them fromaccessing or participating in certain functionalities or transactions
within the contract. This can be useful in preventing fraudulent ormalicious activities, such as hacking attempts or money laundering.
Contract owner cannot
blacklist addresses.

The owner cannot blacklist wallets.

Description

The owner cannot blacklist wallets fromtransferring of tokens.

Comment

N/A

16

Fees and Tax
In some smart contracts, the owner or creator of the contract canset fees for certain actions or operations within the contract. These
fees can be used to cover the cost of running the contract, such as
paying for gas fees or compensating the contract's owner for theirtime and effort indeveloping and maintaining the contract.
Contract owner cannot
set fees more than 25%.

The owner cannot set fees more than 25%.

Description

The owner cannot set fees of more than 25%.

Comment

N/A

17

Lock User Funds
In a smart contract, locking refers to the process of restricting accessto certain tokens or assets for a specified period of time. When token
or assets are locked in a smart contract, they cannot be transferred orused until the lock-up period has expired or certain conditions havebeen met.
Contract owner cannot
can locklockfunction.
functions.

lock lockthe contract.
The owner
ownercancannotfunction.

Description

The owner cannot lock the contract.

CommentN/A

18

Centralization PrivilegesCentralization can arise when one or more parties have privileged access orcontrol over the contract's functionality, data, or decision-making. This can occur,for example, if the contract is controlled by a single entity or if certain participants
have special permissions or abilities that others do not.

In the project, there are authorities that have access to the following
functions:
FileToken.solPrivileges➢ There are no ownership privileges in this contract.

Recommendations
To avoid potential hacking risks, it is advisable for the client to manage
the private key of the privileged account with care. Additionally, we
recommend enhancing the security practices of centralized privilegesor roles in the protocol through a decentralized mechanism or smartcontract-based accounts, such as multi-signature wallets.
Here are some suggestions of what the client can do:- Consider using multi-signature wallets: Multi-signature wallets
require multiple parties to sign off on a transaction before it can be
executed, providing an extra layer of security e.g. Gnosis Safe
- Use of a timelock at least with a latency of e.g. 48-72 hours forawareness of privileged operations- Introduce a DAO/Governance/Voting module to increasetransparency and user involvement- Consider Renouncing the ownership so that the owner cannot
modify any state variables of the contract anymore. Make sure to set
up everything before renouncing.

19

Audit Result
Critical Issues
No critical issues
High Issues
No high issues
Medium Issue
No medium issues
Low Issue
No low issuesInformational Issue#1 | Contract doesn’t import packages from source (like OpenZeppelin etc.).
FileToken.sol

Severity

Location

StatusInformational--

ACK

Description – We recommend to import all packages from npm directly
without flatten the contract. Functions could be modified or can besusceptible to vulnerabilities.

20Legend for the Issue Status
Attribute or Symbol

Meaning

Open

The issue is not fixed by the project team.

Fixed

The issue is fixed by the project team.

Acknowledged(ACK)The issue has been acknowledged or declared aspart of business logic.

21