KOLNET security record

The function `transfer()` will charge the transfer fee `txFee` which is not included in the transfer amount. This logic of charging an extra fee beyond the transfer amount is very dangerous when the token is in several trading pairs. There are attacks using pair functions such as `skim()/sync()` and the extra fee logic to lower the balance of a trading pair which successfully manipulated the token price. For example, a recent attack performed on a token will charge an extra fee when transferring to `uniswap` pairs. The fee is not included in the transfer amount and transferring between pools still charges the fee, so the token balances after the function call will be lower than the reserve rate. After calling the `sync()` function to update the reserve rate to the current balance, the token price will be successfully manipulated. This is against the `uniswap` design and allows the malicious user to arbitrarily modify the reserve rate.

In the contract `Token`, the role `MINTER_ROLE` has authority over the following functions: - function mint() In the contract `Token`, the role `SNAPSHOT_MANAGER_ROLE` has authority over the following functions: - function snapshot() In the contract `Token`, the role `PAUSE_MANAGER_ROLE` has authority over the following functions: - function pause() - function unpause() In the contract `Token`, the role `TXFEE_MANAGER_ROLE` has authority over the following functions: - function setupTxFee() In the contract `LosslessERC20`, the role `recovery admin` has authority over the following functions: - function setLosslessAdmin() - function transferRecoveryAdminOwnership() - function proposeLosslessTurnOff() - function executeLosslessTurnOff() - function executeLosslessTurnOn() In the contract `LosslessERC20`, the role `lossless` has authority over the following functions: - function transferOutBlacklistedFunds() Additionally, address `txFeeBeneficiary` will be used to receive transaction fee. Any compromise to the above roles/accounts may allow a hacker to take advantage of this authority.