The Green World - Audit

In the contract `TheGreenWorld`, the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the token buying contract, add a dex address, prevent ownership transfer, retrieve lost tokens from the contract, update the PancakeSwap router, remove the dex address, and renounce ownership with a revert message.  In the contract `TheGreenWorld`, the role `dexAddresses` has authority over the functions shown in the diagram below. Any compromise to the `dexAddresses` account may allow the hacker to take advantage of this authority and prevent ownership transfer.  In the contract `TheGreenWorld`, the role `owner` has authority over the functions shown in the diagram below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and set the token buying contract, remove dex address, add dex address, retrieve and transfer lost tokens, update PancakeSwap router, revert ownership transfer, and renounce ownership disallowed. 

The `transferFrom` function allows a spender to transfer tokens from the `from` account to the `to` account. The following check includes a comment indicating that the function cannot be used during a buy operation: ```solidity function transferFrom(address from, address to, uint256 amount) public override returns(bool) { require(to != address(0), "Transfers to the zero address (burn) are not allowed"); @> require(!_isBuyingOnPancakeSwap(from, to), "Buying from PancakeSwap is restricted"); emit TokenTransferFrom(msg.sender, from, to, amount); return super.transferFrom(from, to, amount); } ``` A similar validation is held by `transfer` as well. However, this check is incorrect in validating whether a token transfer occurs during a buy transaction. A buy operation involves users transferring another asset to the pair address and receiving `TGW` tokens in return from the pair. In this scenario, the token sender is the pair address, and the receiver (`to`) is the user's address. According to the logic in the following code: ```solidity function _isBuyingOnPancakeSwap(address from, address to) internal view returns (bool) { return from != pancakeSwapPair && to == pancakeSwapPair; } ``` `_isBuyingOnPancakeSwap` will return `false`. Consequently, the check `require(!_isBuyingOnPancakeSwap(from, to), "Buying from PancakeSwap is restricted")` will return `true`, allowing the user to initiate a buy operation via this function, which violates the intended design.

All of the `The Green World` tokens are sent to the contract deployer. This is a centralization risk because the deployer can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.