BitBase World security record

The `claimToken()` function is designed for the `_owner` to withdraw LP tokens from `_lpsDistributor`. However, the `_lpsDistributor` has not approved the contract to transfer LP tokens on its behalf. This lack of approval impedes the contract's ability to effectively withdraw LP tokens from `_lpsDistributor`. While this issue is deemed minor due to `_lpsDistributor` not being the direct recipient of the `_swapRouter.addLiquidity()` function, it still represents a gap in the intended functionality of the `claimToken()` function. ```solidity=667 function claimToken( address token,uint256 amount,address to) external onlyOwner{ if(token == rewardToken){ IERC20(token).transferFrom( address(_rewardDistributor), to, amount); }else if(token == _mainPair){ IERC20(token).transferFrom( address(_lpsDistributor), to, amount); }else{ IERC20(token).transfer(to, amount); } } ```

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=609 _lpsAddress = lpsAddress; ``` - `lpsAddress` is not zero-checked before being used. --- ```solidity=610 _teamAddress = teamAddress; ``` - `teamAddress` is not zero-checked before being used. --- ```solidity=611 _tokenAddress = tokenAddress; ``` - `tokenAddress` is not zero-checked before being used. --- ```solidity=612 _marketAddress = marketAddress; ``` - `marketAddress` is not zero-checked before being used.