L2Finance security record

There are no upper boundaries for **sellBurnFee**. It is possible to set the total fee rate up to any arbitrary amount.

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=727 uint256 burnAmount = amountL2FIIn.div(1000).mul(sellBurnFee); ``` --- ```solidity=820 uint256 burnedAmount = excludeFee[msg.sender] ? 0 : amountL2FIIn.div(1000).mul(sellBurnFee); ```

In the view function `estimatedUSDTOut()`, unlike the function `swapForUSDT`, the `excludeFee` logic is not considered. Hence it might not return accurate values for excludeFee users.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=599 _usdtAddr = USDTAddr; ``` - `USDTAddr` is not zero-checked before being used. --- ```solidity=600 _key = key; ``` - `key` is not zero-checked before being used. --- ```solidity=684 _key = _value; ``` - `_value` is not zero-checked before being used.

The linked statements do not affect the functionality of the codebase. The contract has to maintain two different mappings: _swap and _swapAllow. However, they have no obvious differences. The internal function `_burnFrom()` is defined but never called. The `reclaimEther()` function is redundant since there is no payable function or receive() function in the contract.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=531 IERC20(token).transfer(owner(),amount); ```

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.