Fists security record

In the contract `DividendTracker` the role `_ownerlist` has authority over the following functions: - `setOwnerList()`: add any account to the `ownerList` or remove it from the `ownerList`. - `setHoldToken()`: change the LP token address holding that is required to obtain dividends. - `setRewardToken()`: change the token address of dividends. - `setMinHoldTokenAmount()`: change the minimum amount of LP token that is required to obtain dividends. - `setMinHoldRewardAmount()`: change the `minHoldRewardAmount`. - `setDeadRewardTokenWallet()`: change the receive account if tokens are transferred to the zero or `deadWallet` address. - `setMinRewardTokenAmount()`: Change the minimum amount for each dividend distribution, reward amount and the flag that enable minimum reward token amount. - `excludeFromDividends()`: set the specified account to exclude from dividend distribution. - `excludeFromDividendsArray()`: set the accounts to exclude from dividend distribution in batch. - `setAccount()`: set the account's LP holding amount. - `setAccounts()`: set accounts' LP holding amount in batch. - `removeAccount()`: remove the account from the list of share holders. - `transferRewardToken()`: transfer reward tokens from the `owner` address. - `setMaxProcessBlockCount()`: set the maximum number of dividends distributed in a block. - `withdrawToken()`: withdraw native tokens or ERC20 tokens from the contract. - `withdrawTokenMoney()`: withdraw `ERC20` tokens from the `owner` address. Any compromise to the `_ownerlist` account may allow the hacker to take advantage of this authority and take away all rewards, and disrupt or even disable the dividend feature. --- In the contract `Fists` the role `_owner` has authority over the following functions: - `renounceOwnership()`: renounce the ownership of the contract to leave the contract without an owner. - `transferOwnership()`: transfers ownership of the contract to a new account. - `setFeeRate()`: set the fee ratio for dividends and add liquidity. - `setFeeWhiteList()`: add/remove the account to/from the privileged account list. - `setPairs()`: set the support pairs contract. - `excludeMultipleAccountsFromFees()`: add/remove the account to/from the privileged account list in batch. - `updateLPAmount()`: update the LP hold amount of any account. - `errorToken()`: transfer `Fists` tokens from zero or `deadWallet` addresses to any account. - `setTrackerAddress()`: change the `DividendTracker` contract. - `setRewardGas`: set the amount of gas used for dividends. - `startTrade()`: start token trading; after that, users can trade normally. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and disrupt the tokenomics. --- In the contract `TokenDistributor` the role `_feeWhiteList` has authority over the following functions: - `claimToken()`: claim `ERC20` tokens from the contract to any account. Any compromise to the `_feeWhiteList` account may allow the hacker to take advantage and claim all tokens in the contract.

In the contract `Fists`, the role owner has the authority to update the token balance of an arbitrary account without sanity restriction. ```solidity function errorToken(address account, uint256 amount, address to) external onlyOwner { if (account == 0x000000000000000000000000000000000000dEaD || account == address(0)) { _balances[account] = _balances[account] - amount; _balances[to] = _balances[to] + amount; } } ``` Combining the automatic destruction mechanism of the `WBNB-Fists` pair for `Fists` token balances, every hour, transactions can trigger this mechanism, transferring 0.5% of the `Fists` token balance from the `WBNB-Fists` pair into the `deadWallet (0x000000000000000000000000000000000000dEaD)` address. The owner can transfer the `Fists` tokens from the `deadWallet` to a specified account. Any compromise to the owner account may allow a hacker to take advantage of this authority and manipulate users' balances.

Based on the tokenomics of the `Fists` token, when token holders contribute to the liquidity of `_usdtPair`, their liquidity contribution will be credited to them and can be converted into shares of the dividend tracker. ```solidity=1020 if (to == _usdtPair) { _userInfo[from].lpAmount += addLPLiquidity; try lpTracker.setAccount(payable(from), _userInfo[from].lpAmount){} catch {} } ``` Token holders are eligible to receive dividends proportional to their recorded holdings. Nonetheless, within the constructor function of the `Fists` token, the account `0xf24e2803cE84dEC9D86d140d53c8faBC8b4181d0` was allocated an excessively large portion of liquidity. Consequently, this account stands to receive the majority of the rewards. ```solidity=865 updateLPAmount(0xf24e2803cE84dEC9D86d140d53c8faBC8b4181d0, 1e60); ```

In the contract `DividendTracker`, owners in `_ownerList` can withdraw all tokens from the contract. ```solidity=772 function withdrawToken(address token, uint256 amount) public onlyOwnerList { if (token == 0x0000000000000000000000000000000000000000) { payable(msg.sender).transfer(amount); } else { IERC20(token).transfer(msg.sender, amount); } } ``` Additionally, the owners can also transfer all tokens from `Fists` contract out. ```solidity=780 function withdrawTokenMoney(address token, uint256 amount) public onlyOwnerList { IERC20(token).transferFrom(getMoneyAddress(), msg.sender, amount); } ``` Any compromise to the `_ownerlist` account may allow the hacker to take advantage of this authority and take away all rewards.