0xLSD security record

The `donateERC20()` function can be used to transfer any ERC20 tokens in the contract to external address `0xAa6CBca21980174Ac9f517a0A627156a551a2B6B`. However, it is noted that `donateERC20()` function does not check if the `tokenAddress` is current token contract. As a result, the `holder` role can transfer `0XLSD` to `0xAa6CBca21980174Ac9f517a0A627156a551a2B6B`, which may have a negative impact on the project.

There are many hardcoded addresses in current contract. Please ensure these addresses are configured correctly when deploying.

It is noted that the contract creates an approval for USDT in the `constructor()`. ```solidity=1095 _approve(usdt, address(router), type(uint256).max); ``` This statement serves to create an approval to the `router` contract to transfer `0XLSD` tokens stored within the `usdt` contract. The audit team would like to understand the intent of this approval and confirm if this matches the intended design.

Signed messages are not properly verified with the current chain ID, thus allowing attackers to perform replay attacks across chains. Hardcoded or cached chain ID values are also vulnerable since a hard fork may occur and change the chain ID in the future. ```solidity=1145 require(ECDSA.recover(message, signature) == key,"0XLSD: SIGN ERROR"); ``` - Calling `recover()`, which eventually calls `ecrecover()`. --- ```solidity=1192 require(ECDSA.recover(message, signature) == key,"0XLSD: SIGN ERROR"); ``` - Calling `recover()`, which eventually calls `ecrecover()`.

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to execute transactions on-chain.

SafeTransfer functions should be used in place of Transfer functions for Solidity contracts to ensure robust security and error handling. Unlike the basic Transfer functions, SafeTransfer functions incorporate safeguards against potential smart contract vulnerabilities, such as unexpected token loss. By automatically validating the recipient's ability to receive tokens and reverting transactions in case of failures.

State variables that never change should be declared as `constant` to save gas. ```solidity=1064 bool public canSet = true; ``` - `canSet` should be declared `constant`. --- ```solidity=1065 uint256 public _burnRate = 5; ``` - `_burnRate` should be declared `constant`. --- ```solidity=1066 uint256 public _baseFee = 100; ``` - `_baseFee` should be declared `constant`. --- ```solidity=1067 uint256 public _buy = 99; ``` - `_buy` should be declared `constant`. --- ```solidity=1068 uint256 public _sell = 5; ``` - `_sell` should be declared `constant`. --- ```solidity=1070 address public usdt = address(0x55d398326f99059fF775485246999027B3197955); ``` - `usdt` should be declared `constant`. --- ```solidity=1071 IPancakeRouter01 router = IPancakeRouter01(0x10ED43C718714eb63d5aA57B78B54704E256024E); ``` - `router` should be declared `constant`.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=1071 IPancakeRouter01 router = IPancakeRouter01(0x10ED43C718714eb63d5aA57B78B54704E256024E); ``` - The contract `BEP20_0XLSD` interacts with third party contract with `IPancakeRouter01` interface via `router`. --- ```solidity=1073 IPancakeFactory factory = IPancakeFactory(router.factory()); ``` - The contract `BEP20_0XLSD` interacts with third party contract with `IPancakeFactory` interface via `factory`.

It was noted that the buying fee `_buy` is set to an extremely high value of 99%. We would like to understand the intent of this high fee and confirm if this matches the intended design.

The smart contract does not check or store the return value of an external call in a local or state variable, which may introduce vulnerabilities due to the unhandled outcome. ```solidity=1186 router.swapExactTokensForTokens(swapNum, minOut, path, msg.sender, block.timestamp); ```