Glow Token V2 security record

In the function `_processRewards`, the gas may be insufficient in the last iteration of the while-loop, which will lead to the reversion of EVM. The function `_transfer` calls the function `_processRewards` when selling, so it may cause the sell transaction can not be executed successfully.

The variable `_nonce` is used in function `_random` to make a random number. However, it is always the initial zero and never changed.

It is recommended to add `indexed` keyword for parameters in events, which makes it easier for users to navigate event logs.

The order of external call/transfer and storage manipulation must follow the check-effect-interaction pattern.

In function `_buyTokens`, the transaction may be charged fees, so the max holding of receiver should be `_balances[recipient] + amount - tokenTax`. The fees should not be calculated in the max holding.

In function `_addLiquidity` and `_swapTokensForBNB`, the `_pancakeRouter` transfers token without approval. Although the `_pancakeRouter` is approved with the max allowance in the constructor, the allowance may be decrease to an insufficient amount over time. Besides, if the router has been changed, there will no allowance for the new router, which will cause reversion of transaction.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller. But there are a lot of `require`s in the code that do not have error messages.

In the function `_transferIncluded`, the `newAmount` is sent to `recipient` and the `tokenTax` is sent to `address(this)`. So only emit for `recipient` is not enough.

There are many functions in the contract which do not check for the given input values, such as zero address validation, BEP20 token address validation.

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - _pancakeRouter.swapExactETHForTokensSupportingFeeOnTransferTokens() - _pancakeRouter.addLiquidityETH() - _pancakeRouter.removeLiquidityETHSupportingFeeOnTransferTokens() - _pancakeRouter.swapExactTokensForETHSupportingFeeOnTransferTokens()