MBD Financials security record

In the contract `MBD` the role `_owner` has authority over the functions shown in the diagram below.  - `updateVotesNeeded(uint256 _votesNeeded)`: Updates the minimum number of votes needed for a proposal to be considered. Access is restricted to the owner of the contract. - `excludeFromReward(address account)`: Excludes an account from receiving reward distributions. Only the contract owner can call this function. - `includeInReward(address account)`: Includes an account back into the reward distribution. Only the contract owner can call this function. - `excludeFromFeeByOwner(address account)`: Excludes an account from having to pay transaction fees. Only the contract owner can call this function. - `includeInFeeByOwner(address account)`: Removes an account's exclusion from transaction fees, making them subject to fees again. Only the contract owner can call this function. - `setTaxFeePercent(uint256 taxFee)`: Sets the percentage of the tax fee for transactions. It is restricted to the owner and includes a check for total fee limits. - `setLiquidityFeePercent(uint256 liquidityFee)`: Sets the percentage of the liquidity fee for transactions. This function is restricted to the owner and includes a check for total fee limits. - `setMarketingFeePercent(uint256 marketingFee)`: Sets the percentage of the marketing fee for transactions. Access is limited to the owner and includes a check for total fee limits. - `setMaxTxPercent(uint256 maxTxPercent)`: Sets the maximum transaction amount as a percentage of total supply. Only the contract owner can call this function. - `setSwapAndLiquifyEnabled(bool _enabled)`: Toggles the state of the swap and liquify function. This is a privileged function that only the contract owner can call. - `setMarketingFeeAddress(address _marketingAddress)`: Sets the marketing fee wallet address. Only the contract owner has the privilege to call this function. - `addGovernance(address _governance)`: Adds an address to the list of governance addresses. Only the owner can call this function. - `removeGovernance(address _governance)`: Removes an address from the list of governance addresses. Only the owner can call this function. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project.

All of the initial tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

The function `_transfer` is designed to limit the amount of tokens transferred in a single transaction. However, the owner account may be exempted from this limit.

The logical condition within the `_transfer` function of the ERC20 token contract potentially incorrectly restricts the maximum transaction amount. The change from a logical OR (`||`) to a logical AND (`&&`) in the conditional check inadvertently allows transactions that exceed the `_maxTxAmount` limit if either `from` or `to` addresses are excluded from the maximum amount check. A user performs a token transfer where either the `from` address or the `to` address (but not both) is intended to be exempt from the maximum transaction amount check. However, with the current logic, the transaction will not be subject to the `_maxTxAmount` check, allowing potentially unrestricted transfer sizes.

The report gives no description here.