Shadowfi

Accessing storage variables in a loop can be costly in terms of gas consumption. As the amount of holders grow, the more expensive it becomes to call these functions.

The following functions are never called internally within the contract and should have external visibility: In `[ShadowFi.sol]`: - `authorizeFor()` - `authorizeForMultiplePermissions()` - `unauthorizeFor()` - `unauthorizeForMultiplePermissions()` - `isAuthorizedFor()` - `transferOwnership()` - `getPermissionNameToIndex()` - `isLocked()` - `lockPermission()` - `unlockPermission()` - `burn()` --- In `[ShadowFiLiquidityVault.sol]`: - `transferOwnership()` - `endLock()` - `extendLockTime()` - `withdrawBNB()` - `withdrawTokens()` - `shadowStrike()` - `shadowBurst()` - `getLPOwnershipPercent()` - `getLiquidTokens()` - `getLiquidPercent()` - `getShadowStrikeAmount()` - `getShadowBurstAmount()` - `injectBNB()` - `getLockTime()`

Functions should be grouped together based on their functionality. For example: - All centralized user functions should be listed together. - All trading or swapping mechanisms should be listed together.

There are three different ways to gain access to certain admin functions: - `authorized` - `authorizedFor` - `onlyToken` This can make it difficult for users to keep track of centralized roles.

If `totalShares()` is set to zero, then the tx will revert. This will happen due to a compiler erorr.

The contract is serving as the underlying entity to interact with one or more third-party `AMM` protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc.

The Try-Catch pattern is used for external function calls to the `dividendDistributor` contract. This can lead to unintended behaviour. For example: if there is not sufficient gas to call the external function `setShare` then the loop will continue. This will result in some shareholders from not receiving rewards.

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow.

The return value of an external call is not stored in a local or state variable. ```solidity=792 try router.addLiquidityETH{ value: amountBNBLiquidity }( address(this), amountToLiquify, 0, 0, autoLiquidityReceiver, block.timestamp ) { emit AutoLiquify(amountToLiquify, amountBNBLiquidity); } catch { emit AutoLiquify(0, 0); } ``` --- ```solidity=508 pancakePairToken.approve(address(pancakeRouter), removeAmount); ``` --- ```solidity=541 pancakePairToken.approve(address(pancakeRouter), removeAmount); ``` --- ```solidity=611 shadowFiToken.approve(address(pancakeRouter), _amountToken); ```