Glow Token V2 security record

In the contract `Ownable`, the role `owner` has authority over the following functions: - renounceOwnership - transferOwnership In the contract `GlowTokenV2`, the role `owner` has authority over the following functions: - ownerCreateLP - ownerUpdatePancakePair - ownerUpdateAMM - ownerLockTeamWallet - ownerBurnInitialToken - ownerSetAirDropper - ownerBoostContract - ownerLockAllTeamTokens - ownerReleaseLP - ownerRemoveLPPercent - ownerUpdateDefaultRewardToken - ownerExtendLPLock - ownerBlacklistWallet - ownerEnableTrading - ownerUpdatePrimaryTaxes - ownerUpdateSecondaryTaxes - ownerUpdateSwapThreshold - ownerTriggerSwap - ownerTriggerLottery - ownerSwitchSwapEnabled - ownerSwitchLotteryEnabled - ownerSwitchRewardsEnabled - ownerSetLotterySettings - ownerSetRewardSettings - ownerSetExcludeFromRewards - ownerSetIncludedToRewards - ownerSetExcludeFromLottery - ownerSetIncludedToLottery - ownerExcludeFromFees - ownerWithdrawMarketingBNB - ownerWithdrawCharityBNB - ownerWithdrawStrandedToken - ownerFixStuckBNB - ownerWithdrawBNB In the contract `GlowTokenV2`, the role `airDropper` has authority over the following functions: - withdrawAirDropTokens - withdrawAirDropTokenPresale Any compromise to these account may allow a hacker to take advantage of this authority.

The owner can remove the liquidity added by contract. If the `_owner` is an EOA (Externally Owned Account), mishandling of its private key can have devastating consequences to the project as a whole.

```solidity uint256 oldBNB=address(this).balance; _removeLiquidityPercent(100); uint256 newBNB=address(this).balance-oldBNB; require(newBNB>oldBNB); _tracker.totalMarketingBNB+=(newBNB-oldBNB); ``` The `newBNB` should be `address(this).balance` in function `ownerReleaseLP` and `ownerRemoveLPPercent`.

The `20,000,000,000,000` tokens are sent to the centralized address `owner` in function `ownerCreateLP`. The `292,062,312,300,925` tokens are sent to the centralized address `airDropper` in function `withdrawAirDropTokens`. The `70,000,000,000,000` tokens are sent to the centralized address `airDropper` in function `withdrawAirDropTokenPresale`. All these may raise the community's concerns about the centralization issue.

```solidity=344 function _sendLotteryReward(uint256 percentage) private returns (bool) { uint rand = _random(); while(_balances[holders[rand]]< _lottery.minBalance){ rand = _random(); } address payable winningAddress = payable(holders[rand]); uint256 amountWei = _tracker.totalLotteryBNB*percentage/100; _swapBNBtoRWRD(winningAddress, amountWei); _tracker.totalLotteryBNB-=amountWei; _lottery.lastLottery = block.timestamp; return true; } ``` In function `_sendLotteryReward`, the lottery winner should have more token balance than `_lottery.minBalance` so that he can claim the reward. It is obvious a waste of gas to get the suitable random number in a while loop, which even may use out all the gas and cause the out-of-gas exception.

The function `ownerUpdatePancakePair` updates the router and pair incompletely, which may cause problems. - Only update `_pancakeRouterAddress` is not enough, `_pancakeRouter` has not been updated - The new router has not been approved - Related states has not been updated, such as `_excludeFromRewards`, `_excludeFromLottery`

Weak PRNG due to a modulo on `block.timestamp, block.difficulty, msg.sender, block.coinbase, block.number`. These can be influenced by miners to some extent, so they should be avoided.