MEME MINT security record

It is possible for a user to acquire an arbitrary number of `DividendPayingToken` tokens, assuming the user has at least the minimum amount of `MEME_MINT` tokens for dividends. The cause is that while transferring `MEME_MINT` tokens updates users' `DividendPayingToken` token balances, the opposite is not true. This allows a user to transfer `DividendPayingToken` tokens to another account and mint more of such tokens through transferring `MEME_MINT` tokens. When transferring `MEME_MINT` tokens, the sender and recipient's dividend token balances are set to their corresponding `MEME_MINT` balance. ```solidity=427 super._transfer(from, to, amount); dividendTracker.setBalance(from, balanceOf(from)); dividendTracker.setBalance(to, balanceOf(to)); ``` However, there is no such logic when transferring the dividend tokens themselves, meaning a user can transfer the dividend tokens to another address and transfer 0 `MEME_MINT` tokens to themself to be minted dividend tokens. As the total supply of `DividendPayingToken` tokens affects the number of dividends received, a user is able to acquire a large share of the dividends through this exploit. ```solidity=117 function accumulativeDividendOf(address account) public view override returns(uint256) { return ((magnifiedDividendPerShare * balanceOf(account)).toInt256Safe() + magnifiedDividendCorrections[account]).toUint256Safe() / magnitude; } ``` Furthermore, even though the account creating the minted tokens will not be able to claim dividends due to `magnifiedDividendCorrections`, they can simply transfer the dividend tokens to a separate account and acquire dividends through that separate account through `DividendTrackerFunctions.claim()`.

`addLiquidity()` uses `lpTokensReceiver` address as a LP recipient. This allows the `lpTokensReceiver` to extract all the funds from the AMM pair.

When withdrawing dividends, try/catch is used when transferring the dividends. ```solidity=91 try IERC20(rewardToken).transfer(account, withdrawableDividend) returns (bool) { emit DividendWithdrawn(account, withdrawableDividend); return withdrawableDividend; ``` This means that if the `rewardToken.transfer()` method returns `false` and does not actually transfer tokens, the contract `DividendPayingToken` will still consider the dividends as withdrawn by emitting the `DividendWithdrawn` event.

The function `excludeFromDividends()` is meant to exclude addresses from dividends by removing the address from the `tokenHoldersMap` and sets their dividend token balance to 0. ```solidity=227 function excludeFromDividends(address account, uint256 balance, bool isExcluded) external onlyOwner { if (isExcluded) { require(!isExcludedFromDividends[account], "DividendTracker: This address is already excluded from dividends"); isExcludedFromDividends[account] = true; _setBalance(account, 0); tokenHoldersMap.remove(account); ``` However, when claiming dividends, the `tokenHoldersMap` and the `isExcludedFromDividends` mapping are not checked. This means that if dividend tokens were directly transferred to an excluded address, the excluded address would be able to claim dividends.

The `tokenHoldersMap` details all dividend token holders as well as their balances. However, this mapping is unaffected by dividend token transfers. It is updated when `MEME_MINT` tokens are transferred, but not dividend tokens themselves, resulting in possible inaccurate data. As `tokenHoldersMap` is used for auto claims, it is possible for some users to be unable to participate in this feature.

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.