0xLSD security record

In the `swapToOX()` function, the contract swaps `USDT` for `0XLSD` tokens. Subsequently, the contract invokes the `burn()` function to burn `burnNum` number of `0XLSD` tokens directly from the function caller `msg.sender`. However, it is noted that the contract imposes a significantly high fee on the buyer unless the ` isTxFeeExempt[msg.sender]` is set to `true`. Consequently, the `msg.sender` only receives 1% of `outAmounts[1]` (since the buy fee `_buy` is set at 99%), which is actually lower than the `_burnRate` of 5% and ultimately leads to the failure of transaction.

In the `swapToUSDT()` function, the contract swaps the `0XLSD` tokens transferred from the function caller `msg.sender` for `USDT`, and these `USDT` are directly transferred back to the `msg.sender`. During the swap, the contract uses `amount - burnNum` as the input for the swap instead of the original `amount`. However, it is noted that the contract invokes the public `burn()` function, which burns the `burnNum` amount of `0XLSD` tokens from `msg.sender` instead of from the contract `0XLSD`, which is where the tokens have been transferred to. As a result, the contract retains the `burnNum` amount of `0XLSD` tokens, leading to the accumulation of these tokens within the contract's holdings. An added note is that this function will fail if the user transfers all available tokens to the contract through this function, since there will be no tokens left in the balance of the `msg.sender` to burn.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=1086 key = _key; ``` - `_key` is not zero-checked before being used. --- ```solidity=1105 key = _new; ``` - `_new` is not zero-checked before being used.

Some state variables are not used in the codebase. This can lead to incomplete functionality or potential vulnerabilities if these variables are expected to be utilized. The following variables are declared but never used within the code. ```solidity=1064 bool public canSet = true; ``` ```solidity=1073 IPancakeFactory factory = IPancakeFactory(router.factory()); ```