RESOU security record

In the contract `RESOU` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and steal tokens from the contract, make the contract malfunction. 

All of the `RESOU` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

It is possible that the `_NFT` variable is not initialized in constructor and `swapAndTrans()` is called by someone, then native tokens are transferred to zero address and lost.

The `usdt` address returned by `getToken()` points to WETH token address, NOT USDT token address.

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=872 uint256 every = amount.div(100); ``` ```solidity=874 super._transfer(from, address(this), every * 3); ``` --- ```solidity=882 uint256 every = amount.div(100); ``` ```solidity=884 super._transfer(from, address(this), every * 3); ``` --- ```solidity=957 uint every = balanceOf(address(this)) / 10; ``` ```solidity=958 uint amount = every * 6; ```

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `swapTokensForBNB()` - `addLiquidity()` - `buyBackTokens()`

State variables that never change should be declared as `constant` to save gas. ```solidity=801 address private _dead = 0x000000000000000000000000000000000000dEaD; ``` - `_dead` should be declared `constant`.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=802 address private _swapPair; ``` - The contract `RESOU` interacts with third party contract with `ISwapPair` interface via `_swapPair`. --- ```solidity=804 ISwapRouter private _ROUTER; ``` - The contract `RESOU` interacts with third party contract with `ISwapRouter` interface via `_ROUTER`. --- ```solidity=805 INFT private _NFT; ``` - The contract `RESOU` interacts with third party contract with `INFT` interface via `_NFT`.

The return values of the `transfer()` and `transferFrom()` calls in the smart contract are not checked. Some ERC-20 tokens' transfer functions return no values, while others return a bool value, they should be handled with care. If a function returns `false` instead of reverting upon failure, an unchecked failed transfer could be mistakenly considered successful in the contract. ```solidity=842 token.transfer(msg.sender, amount); ```

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=166 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=795 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `RESOU` contract. ```solidity=872 uint256 every = amount.div(100); ``` - `SafeMath.div` is called in `_transfer` function of `RESOU` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 3) are shown above.*