MEME MINT security record

In contract `Token`, the role `owner` has authority over the following functions: - `updateSwapThreshold`: Update the swap threshold. - `teamAddressSetup`: Set the team address. - `teamFeesSetup`: Set the team serve fees. - `marketingAddressSetup`: Set the marketing address. - `marketingFeesSetup`: Set the marketing fees. - `autoBurnFeesSetup`: Set the auto burn fees. - `lpTokensReceiverSetup`: Set the lp token receiver address. - `liquidityFeesSetup`: Set the liquidity fees. - `excludeFromDividends`: Set the address's status in the `dividendTracker` contract. - `rewardsFeesSetup`: Set the reward fees. - `excludeFromFees`: Set the account's status in the mapping `isExcludedFromFees`. - `setAMMPair`: Set the amm pair. In contract `DividendTracker`, the role `owner` has authority over the following functions: - `setRewardToken`: Set the reward token address. - `excludeFromDividends`: Exclude the address from the mapping `isExcludedFromDividends`. - `claimWaitSetup`: Set the value of `claimWait`. - `claim`: Claim the dividend. - `setBalance`: Set the `DividendTracker` token balance for the input `account`. - `process`: Calculate the rounds of claim operations. In contract `DividendTrackerFunctions`, the role `owner` has authority over the following functions: - `gasForProcessingSetup`: Set the value of `gasForProcessing`. - `claimWaitSetup`: Set the value of `claimWait`. Any compromise to the privileged accounts may allow the hacker to take advantage of this authority, manipulate user account balances, and alter sensitive state variables. Such actions could severely impact the project and result in financial losses for users. Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

A great amount (100000000000 * (10 ** decimals()) / 10) of **MEME MINT** tokens are sent to the `supplyRecipient` address. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project. Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

The following functions use `0` as the `amountOutMin` parameter in the swap function, which means it does not protect against price slippage: - `_swapTokensForOtherTokens()`. - `_swapTokensForCoin()`. - `_swapTokensForOtherRewardTokens()`. This could lead to a situation where the swap is executed at a very unfavorable rate.

The contract works this way: 1. On each `transfer()` a share of the amount is taken and stored on `address(this)` 2. In certain conditions `_swapAndLiquify()` is called 3. During that accumulated fees is converted into native tokens 4. Then `uniswapV2Router.addLiquidity()` is called with half fees stored and the converted amount of native token 5. No price Oracle is used, slippage is not controlled This allows the attacker to steal a part of `balanceOf(this)` via a flashloan attack through the following: 1. Take a flash loan and perform a big swap to skew the price in the pair 2. Force a `_swapAndLiquify()` in the token contract 3. Reverse the swap in step 1 4. Payback flash loan This is possible as one can predict when `_swapAndLiquify()` will occur. Consider that a flash loan can be obtained via any protocol that supports it, except the `uniswapV2Pair` used by `this`. The imbalance can be prepared at `uniswapV2Pair` to make swap operations disadvantageous.

Having both a constructor and an initializer function can result in inconsistencies in how the contract's state is initialized, especially post-upgrade. State variables initialized in the constructor may not persist through upgrades, leading to potential logic flaws or security vulnerabilities.