HashBit security record

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

In the contract `BABYTOKENDividendTracker`, the function `excludeFromDividends()` could only exclude users from dividends. If someone is excluded from dividends by mistake, there is no way to recover. In the contract `AntiBotBABYTOKEN`, the function `excludeFromFees()` could only exclude users from fees. If someone is excluded from fees by mistake, there is no way to recover.

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (executing before the target) a transaction to purchase one of the assets and make profits by backrunning (executing after the target) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens(` - `uniswapV2Router.swapExactTokensForTokensSupportingFeeOnTransferTokens()` - `uniswapV2Router.addLiquidityETH{value: ethAmount}()`

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=2824 IUniswapV2Router02 public uniswapV2Router; ``` - The contract `AntiBotBABYTOKEN` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`. --- ```solidity=2831 address public rewardToken; ``` - The contract `AntiBotBABYTOKEN` interacts with third party contract with `rewardToken` interface via `rewardToken`. --- ```solidity=2851 IPinkAntiBot public pinkAntiBot; ``` - The contract `AntiBotBABYTOKEN` interacts with third party contract with `IPinkAntiBot` interface via `pinkAntiBot`.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby he/she can perform privileged operations that trick unsuspecting users into believing that he/she is the owner of the upgradeable contract. ```solidity=2508 contract BABYTOKENDividendTracker is OwnableUpgradeable, DividendPayingToken { ``` - `BABYTOKENDividendTracker` is an upgradeable contract that does not protect its initializer. ```solidity=2532 function initialize( ``` - `initialize` is an unprotected initializer function.

```solidity=2145 int256 b = int256(a); ``` - The type conversion `int256(a)` from type uint256 to type int256 may flip the value's sign. --- ```solidity=2177 return int256(map.indexOf[key]); ``` - The type conversion `int256(map.indexOf[key])` from type uint256 to type int256 may flip the value's sign. --- ```solidity=2629 int256(lastProcessedIndex) ``` - The type conversion `int256(lastProcessedIndex)` from type uint256 to type int256 may flip the value's sign. --- ```solidity=2638 int256(processesUntilEndOfArray) ``` - The type conversion `int256(processesUntilEndOfArray)` from type uint256 to type int256 may flip the value's sign.

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.