Zahnymous LTD

In the contract `ZAH` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - activate trading prematurely - update the `marketingWallet` and `devWallet` addresses to their own, set fee rates to their maximum, and increase `swapTokensAtAmount` to a large amount, stealing fee funds not designated for them on each `swapBack()` call - exclude their own address from needing to pay fees, giving themselves favorable trading benefits - remove previously added automated market maker pair contract addresses - disable swapping without good reason 

All of the ZAH tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute ZAH tokens without obtaining the consensus of the community.

The approval function of the ERC20 standard possesses a well-known vulnerability whereby two consecutive approvals can be exploited to instead “reset” the approval by consuming the approval that is meant to be replaced with a new one. ```solidity=514 function _approve(address owner, address spender, uint256 amount) private { require(owner != address(0), "ERC20: approve from the zero address"); require(spender != address(0), "ERC20: approve to the zero address"); _allowances[owner][spender] = amount; emit Approval(owner, spender, amount); } ```

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=951 IUniswapV2Router02 public immutable uniswapV2Router; ``` - The contract `ZAH` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.