Mars4 Shoot ERC-20 Security Review

As a typical ERC-20 token, the `ShootERC20` contract does not have a particular function to retrieve funds accidentally transferred to itself. As a result, these accidentally transferred funds will be locked in the contract.

As it is currently constructed, the `ShootERC20` contract is vulnerable to the ERC-20 allowance double-spend exploit, as are most of the known ERC-20 tokens.

Although the `ShootERC20` is a typical ERC-20 token with an additional self-burning feature, it is still recommended to document the use cases of the ERC-20 token, either in the code comments or on a public-facing website. For example, document each role in the system and the expected behavior or possible actions for each role. Additionally, it is recommended that a test suite for smart contracts be developed before they are used in production. The test suite's branch coverage should be at least 90%.

The `ShootERC20` contract has a public `burn()` function, which allows the token holders to burn an arbitrary number of their tokens up to their entire balance. As high-level documentation or code comments for the project are not presented, the intention of such a design choice needs to be clarified. This issue is to note that users and third-party developers need to know that such a public `burn()` function exists.

The `ShootERC20` contract specifies in the header a version number of the format `pragma solidity ^0.8.0;` The caret (`^`) before the version number implies an unlocked pragma, meaning that the compiler may use the specified version and above, hence the term "unlocked".