DegenStreetBets security record

In the contract `DSB` the role `ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `ADMIN_ROLE` account may allow the hacker to take advantage of this authority and set properties and - set percentage of tax used to add liquidity or send to marketing address through function `setShares`. - withdraw dust BNB through function `recoverBNB`.  In the contract `DSB` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and enable trading and set the Pinksale address. 

All of the 10**7 tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute all tokens without obtaining the consensus of the community.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=193 pinksaleAddress = pinksale; ``` - `pinksale` is not zero-checked before being used.

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `ROUTER.swapExactTokensForETH()` - `ROUTER.addLiquidityETH()`

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=17 IDexRouter public constant ROUTER = IDexRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E); ``` - The contract `DSB` interacts with third party contract with `IDexRouter` interface via `ROUTER`.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=187 token.transfer(_msgSender(), amount); ```