JOJO-Audit

In the contract `JOJO` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change market and token pair addresses, change market fee and various other configurations to steal tokens and make the contract malfunction. 

When both token sender and receiver are in `swapPairList`, the calculated fee only includes sell-market fee. This might not align with the intended functionality.

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by backrunning (executing after the target) a transaction to sell the asset. ```solidity= function swapTokensForEthToMarket(uint256 tokenAmount) private { // generate the uniswap pair path of token -> weth address[] memory path = new address[](2); path[0] = address(this); path[1] = uniswapV2Router.WETH(); _approve(address(this), address(uniswapV2Router), tokenAmount); // make the swap uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens( tokenAmount, 0, // accept any amount of ETH path, _market, block.timestamp ); } ```

The defined `numTokensSellToMarket` is bigger than `_tTotal`, which does not make sense. And the tokens accumulated in the contract will never be swapped to ETH.