LGT-NFT security record

There is a risk that the owner casually calls the function `setTradeEnabled()` with `_enabled` as `false`, and `launchedAt` will be assigned a value(and `launchedAt` can just be assigned once). `launchedAt` only makes sense when `tradeEnabled` is true. ```solidity=754 function setTradeEnabled(bool _enabled) public onlyOwner { tradeEnabled = _enabled; if (launchedAt == 0) launchedAt = block.number; } ```

The approval function of the ERC20 standard possesses a well-known vulnerability whereby two consecutive approvals can be exploited to instead “reset” the approval by consuming the approval that is meant to be replaced with a new one.

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity=243 function renounceOwnership() public virtual onlyOwner { ``` --- ```solidity=248 function transferOwnership(address newOwner) public virtual onlyOwner { ``` --- ```solidity=339 function name() public view virtual override returns (string memory) { ``` --- ```solidity=347 function symbol() public view virtual override returns (string memory) { ``` --- ```solidity=364 function decimals() public view virtual override returns (uint8) { ``` --- ```solidity=371 function totalSupply() public view virtual override returns (uint256) { ``` --- ```solidity=378 function balanceOf(address account) public view virtual override returns (uint256) { ``` --- ```solidity=390 function transfer(address recipient, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=398 function allowance(address owner, address spender) public view virtual override returns (uint256) { ``` --- ```solidity=409 function approve(address spender, uint256 amount) public virtual override returns (bool) { ``` --- ```solidity=427 function transferFrom( ``` --- ```solidity=449 function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) { ``` --- ```solidity=468 function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) { ``` --- ```solidity=618 function setLiquidityReceiveAddress(address newAddress) public onlyOwner { ``` --- ```solidity=691 function setUniswapV2Pair(address pair, bool val) public onlyOwner { ``` --- ```solidity=701 function isCpalaceed(address account, bool excluded) public onlyOwner { ``` --- ```solidity=707 function excludeMultipleAccountsFromFees(address[] calldata accounts, bool excluded) public onlyOwner { ``` --- ```solidity=719 function setSwapTokensAtAmount(uint256 amount) public onlyOwner { ``` --- ```solidity=723 function setLiquidityFee(uint256 val) public onlyOwner { ``` --- ```solidity=727 function setNftFee(uint256 val) public onlyOwner { ``` --- ```solidity=732 function setDeadFee(uint256 val) public onlyOwner { ``` --- ```solidity=736 function setLpRewardFee(uint256 val) public onlyOwner { ``` --- ```solidity=740 function isExcludedFromFees(address account) public view returns(bool) { ``` --- ```solidity=744 function setLiquidityReceiveAddress(address newAddress) public onlyOwner { ``` --- ```solidity=747 function liquidityReceiveAddress() public view returns(address) { ``` --- ```solidity=751 function setLpRewardReceiveAddress(address newAddress) public onlyOwner { ``` --- ```solidity=754 function setTradeEnabled(bool _enabled) public onlyOwner { ```

There are some hard code addresses in `LGToken` contract.

According to the code, `_isCpalaceed` is a bit like a sniper list. If buyers buy `LGT` within 40 blocks of the start of the launch block, the associated accounts will be pushed into `_isCpalaceed` which means they can not transfer `LGT` out later. However, 40 blocks seems like a lot. In bsc, 40 blocks means 120 seconds. In eth, 40 blocks take more time. ```solidity=779 if (block.number - launchedAt < 40) { _isCpalaceed[to] = true; } ```

```solidity=596 constructor(address token_, address usdt_, address router_, address liquidityReceiveAddress_){...} ``` In the constructor of the contract `LiquidityBackHelper`, the fourth parameter is named `liquidityReceiveAddress_`. However, `lpRewardReceiveAddress_` is passed as the corresponding parameter in the constructor of the contract `LGToken`. ```solidity=655 constructor( string memory name_, string memory symbol_, uint256 totalSupply_, address NftPoolWalletAddr_, address liquidityReceiveAddress_, address lpRewardReceiveAddress_ ) payable ERC20(name_, symbol_) { ... liquidityBackHelper = new LiquidityBackHelper(address(this), USDT, address(_uniswapV2Router), lpRewardReceiveAddress_); ... } ```

The contract has one or more payable functions, but does not have a function to withdraw the fund. ```solidity=655 constructor(...) payable ... ``` ```solidity=688 receive() external payable {} ```

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=230 _owner = msgSender; ``` - `msgSender` is not zero-checked before being used. --- ```solidity=597 token = token_; ``` - `token_` is not zero-checked before being used. --- ```solidity=598 usdt = usdt_; ``` - `usdt_` is not zero-checked before being used. --- ```solidity=599 router = router_; ``` - `router_` is not zero-checked before being used. --- ```solidity=600 liquidityReceiveAddress = liquidityReceiveAddress_; ``` - `liquidityReceiveAddress_` is not zero-checked before being used. --- ```solidity=619 liquidityReceiveAddress = newAddress; ``` - `newAddress` is not zero-checked before being used. --- ```solidity=675 NFtPoolWalletAddress = NftPoolWalletAddr_; ``` - `NftPoolWalletAddr_` is not zero-checked before being used. --- ```solidity=676 lpRewardReceiveAddress = lpRewardReceiveAddress_; ``` - `lpRewardReceiveAddress_` is not zero-checked before being used. --- ```solidity=715 NFtPoolWalletAddress = wallet; ``` - `wallet` is not zero-checked before being used. --- ```solidity=752 lpRewardReceiveAddress = newAddress; ``` - `newAddress` is not zero-checked before being used.

The `LGToken` contract needs the collaboration of contract `LiquidityBackHelper` to complete the `swapAndLiquify` process. The two privileged functions `addLiquidity()` and `setLiquidityReceiveAddress()` are both called by the `LGToken` contract. Hence the owner of `LiquidityBackHelper` should be the contract `LGToken`, otherwise, the entire `LGT` ecosystem will not run properly.