Pepa

In the contract `AntiBotLiquidityGeneratorToken` the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - function excludeFromFee(): exclude addresses from paying fees. - function excludeFromReward(): exclude addresses from reward(reflect mechanism). - function includeInReward(): include addresses for reward(reflect mechanism). - function setTaxFeePercent(): set tax fee percent. - function setLiquidityFeePercent(): set liquidity fee percent. - function setCharityFeePercent(): set charity fee percent. - function setSwapBackSettings(): change the value of `numTokensSellToAddToLiquidity`(swap threshold). - function setEnableAntiBot(): change the value of `enableAntiBot` which controls whether to call a third-party anti-bot checker before token transfer. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - function transferOwnership(): transfer the `_owner` role to another account. - function renounceOwnership(): change the `_owner` address to address(0).

```solidity function includeInReward(address account) external onlyOwner() { require(_isExcluded[account], "Account is already included"); for (uint256 i = 0; i < _excluded.length; i++) { if (_excluded[i] == account) { _excluded[i] = _excluded[_excluded.length - 1]; _tOwned[account] = 0; _isExcluded[account] = false; _excluded.pop(); break; } } } ``` Variable `_rOwned[account]` is not updated in the function `includeInReward()`, which will make the accounts included siphon off the tokens out of the balances of all token holders. The Rate was higher at the moment of the `excludeFromReward(account)` call, so the `_rOwned[account] / _tOwned[account]` ratio is bigger than expected for accounts included in the reward.