THE Protocol ($THE) - Audit

The function `autoBurnLiquidityPairTokens()` that would be triggered in during the transferring of the `THE` token and the function `manualBurnLiquidityPairTokens()` that could be invoked by the owner can burn the `THE` tokens of the `uniswapV2Pair` pair. However, it might not be appropriate that the `THE` tokens are burnt without the approval of other liquidity holders. This will cause the loss of other liquidity holders compared to those who do not hold liquidity.

All of the `THE` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `THE` tokens without obtaining the consensus of the community.

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity=83 function renounceOwnership() public virtual onlyOwner { ``` --- ```solidity=91 function transferOwnership(address newOwner) public virtual onlyOwner { ``` --- ```solidity=280 function name() public view virtual override returns (string memory) { ``` --- ```solidity=288 function symbol() public view virtual override returns (string memory) { ``` --- ```solidity=305 function decimals() public view virtual override returns (uint8) { ``` --- ```solidity=331 function transfer(address recipient, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=339 function allowance(address owner, address spender) public view virtual override returns (uint256) { ``` --- ```solidity=350 function approve(address spender, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=368 function transferFrom( ``` --- ```solidity=396 function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) { ``` --- ```solidity=415 function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) { ``` --- ```solidity=1264 function setAutomatedMarketMakerPair(address pair, bool value) ``` --- ```solidity=1295 function isExcludedFromFees(address account) public view returns (bool) { ```

The comment states `3% from total supply maxWallet`, however the `maxWallet` is actually set to 2%.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction is attacked) a transaction to sell the asset. Potential sandwich attacks could happen in the below cases: - calling `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens` and `uniswapV2Router.addLiquidityETH` without setting restrictions on slippage. - calling the `autoBurnLiquidityPairTokens()` function and the `manualBurnLiquidityPairTokens()` For example, when we want to make a transaction of swapping 100 `THE` for 1 ETH, an attacker could raise the price of ETH by adding `THE` into the pool before the transaction so we might only get 0.1 ETH. After the transaction, the attacker would be able to withdraw more than he deposited because the total value of the pool increases by 0.9 ETH.

State variables that never change should be declared as `constant` to save gas. ```solidity=1048 uint256 public manualBurnFrequency = 30 minutes; ``` - `manualBurnFrequency` should be declared `constant`.

The comparison, `_percent >= 0`, which is always true may be unnecessary. ```solidity=1537 require( _percent <= 1000 && _percent >= 0, "Must set auto LP burn percent between 0% and 10%" ); ```

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=1030 IUniswapV2Router02 public immutable uniswapV2Router; ``` - The contract `THEPROTOCOL` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=591 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=1028 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `THEPROTOCOL` contract. ```solidity=1418 fees = amount.mul(sellTotalFees).div(100); ``` - `SafeMath.mul` is called in `_transfer` function of `THEPROTOCOL` contract.