EmpaFee security record

In the contract `EmpaFeeToken` the role `_owner` has authority over the functions shown in the diagram below.  - `updateSwapTokensAtAmount(uint256 newAmount)`: Updates the threshold amount of tokens that triggers the swap function when accumulated fees reach this amount in the contract. This function is only accessible by the owner. - `updateMaxAmount(uint256 newNum)`: Updates the maximum transaction amount, which limits the amount of tokens that can be bought or sold in a single transaction. This function is only accessible by the owner. - `excludeFromMaxTransaction(address updAds, bool isEx)`: Allows the owner to set which addresses are excluded from the maximum transaction amount checks. This function is only accessible by the owner. - `updateSwapEnabled(bool enabled)`: Enables or disables the swap function, which is used to swap tokens for Ethereum to fund various wallets (like the liquidity pool and charity). This function is only accessible by the owner. - `updateBuyFees(uint256 _EmpaFeeWallet, uint256 _liquidityFee, uint256 _DoctorsWithoutBorders, uint256 _SaveTheChildrenFee)`: Updates the fees for buying transactions, specifying how much goes to different wallets and liquidity. This function is only accessible by the owner. - `updateSellFees(uint256 _EmpaFeeWallet, uint256 _liquidityFee, uint256 _DoctorsWithoutBorders, uint256 _SaveTheChildrenFee)`: Updates the fees for selling transactions, specifying how much goes to different wallets and liquidity. This function is only accessible by the owner. - `excludeFromFees(address account, bool excluded)`: Allows the owner to exclude specific addresses from transaction fees. This function is only accessible by the owner. - `setAutomatedMarketMakerPair(address pair, bool value)`: Sets or unsets a pair as an automated market maker (AMM) pair, which is used for determining buy and sell transactions on DEXs. This function is only accessible by the owner. - `updateEmpaFeeWallet(address newEmpaFeeWallet)`: Updates the wallet address that receives the EMPA fees collected from transactions. This function is only accessible by the owner. - `updateSaveTheChildrenWallet(address newSaveTheChildrenWallet)`: Updates the wallet address that receives donations for Save The Children from transaction fees. This function is only accessible by the owner. - `updateDoctorsWithoutBordersWallet(address newWallet)`: Updates the wallet address that receives donations for Doctors Without Borders from transaction fees. This function is only accessible by the owner. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  - `transferOwnership(address newOwner)`: Transfers ownership of the contract to a new account. This function is only accessible by the owner. - `renounceOwnership()`: Renounces ownership of the contract, leaving it without an owner and unable to call privileged functions. This function is only accessible by the owner. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settings and execute sensitive functionalities of the project

The transaction may be charged fees, so the max holding of the receiver should be the sum of the held tokens and the amount received from the transfer. The fees should not be included in the max holding. ```solidity=1098 require(amount + balanceOf(to) <= maxWallet, "Max wallet exceeded"); ``` - Max holding is checked. ```solidity=1155 amount -= fees; ``` - Receiving amount is adjusted. ```solidity=364 _balances[recipient] = _balances[recipient].add(amount); ``` - Balance is increased by the adjusted amount.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=1046 EmpaFeeWallet = newEmpaFeeWallet ; ``` - `newEmpaFeeWallet` is not zero-checked before being used. --- ```solidity=1051 SaveTheChildrenWallet = newSaveTheChildrenWallet; ``` - `newSaveTheChildrenWallet` is not zero-checked before being used. --- ```solidity=1056 DoctorsWithoutBordersWallet = newWallet; ``` - `newWallet` is not zero-checked before being used.

In function `swapBack()`, event `SwapAndLiquify` is emitted mistakenly. The `tokensForLiquidity` is set as zero at Line 1254. It is falsely used in the event. ```solidity=1261 emit SwapAndLiquify(amountToSwapForETH, ethForLiquidity, tokensForLiquidity); ```