Sanji Inu security record

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

The SANJI token is a fork of the famous Safemoon token. However, the addLiquidity() function has been removed. Without it, the trading pair may suffer poor liquidity.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=135 _owner = newOwner; ``` - `newOwner` is not zero-checked before being used. --- ```solidity=325 _developmentAddress = dev; ``` - `dev` is not zero-checked before being used. --- ```solidity=332 _marketingAddress = markt; ``` - `markt` is not zero-checked before being used.

A sandwich attack may happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by front running (before the transaction being attacked) a transaction to purchase one of the assets and make profits by back running (after the transaction being attacked) a transaction to sell the asset. The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large: - `swapExactTokensForETHSupportingFeeOnTransferTokens()`

The contract is serving as the underlying entity to interact with one or more third-party protocols. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=169 IUniswapV2Router02 public uniswapV2Router; ``` - The contract `Sanji_Inu` interacts with third-party contract with `IUniswapV2Router02` interface via `uniswapV2Router`. --- ```solidity=317 function rescueForeignTokens(address _tokenAddr, address _to, uint _amount) public onlyDev() { ``` - The function `Sanji_Inu.rescueForeignTokens` interacts with third party contract with `Token` interface via `_tokenAddr`.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=319 Token(_tokenAddr).transfer(_to, _amount); ```

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=70 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=142 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `Sanji_Inu` contract. ```solidity=237 _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "ERC20: transfer amount exceeds allowance")); ``` - `SafeMath.sub` is called in `transferFrom` function of `Sanji_Inu` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 24) are shown above.*

One or more state variables are never used in the codebase. Variable `_previousOwner` in `Ownable` is never used in `Sanji_Inu`. ```solidity=110 address private _previousOwner; ``` ```solidity=140 contract Sanji_Inu is Context, IERC20, Ownable { ``` --- Variable `_tOwned` in `Sanji_Inu` is never used in `Sanji_Inu`. ```solidity=144 mapping (address => uint256) private _tOwned; ``` ```solidity=140 contract Sanji_Inu is Context, IERC20, Ownable { ```

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=308 _developmentAddress.transfer(amount.div(2)); ``` - `Sanji_Inu.sendETHToFee` uses `transfer()`.

The report gives no description here.