TangYuanSwap security record

The function Token.setPairs() is used to set the mapping ispair, which means multiple pairs can be registered. This function can be used by the owner and can be used standalone. The function MktCap.setPair() is used to set `MktCap.token1` and `MktCap.pair`. The `MktCap.pair` is the only one marketing pair for the token. This function cannot be used by the owner to change the marketing pair standalone after the project starts. The only correct way is to call the `start()` function which will call the setPairs and setPair together. ```solidity function start(address baseToken,Fees calldata fees_) public onlyOwner{ setPairs(baseToken); setPair(baseToken); setFees(fees_); } ``` Secondly, addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. ```solidity function setPair(address token) public onlyOwner { token1 = token; _tokenDistributor = new TokenDistributor(token1); IERC20(token1).approve(address(router), uint(2 ** 256 - 1)); pair = IFactory(router.factory()).getPair(token0, token1); } ``` --- `token` is not zero-checked before being used.

Reading, initializing, and modifying storage variables cost more gas than operating local variables, and this gas cost can significantly increase when these operations are performed inside a loop. Reference: https://docs.soliditylang.org/en/latest/introduction-to-smart-contracts.html#storage-memory-and-the-stack [internal use only: e.g., https://github.com/crytic/slither/wiki/Detector-Documentation#costly-operations-inside-a-loop] ```solidity=122 ktNum = ktNum+1; ``` --- ```solidity=124 ktNum = ktNum+1; ```

Performing division by zero would raise an error and revert the transaction. ```solidity=161 uint toBurn = amount.mul(allot.burn).div(allot.total); ``` The expression `amount.mul(allot.burn).div(allot.total)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=162 uint toAddL = amount.mul(allot.addL).div(allot.total).div(2); ``` The expression `amount.mul(allot.addL).div(allot.total)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=171 IERC20(token0).totalSupply().mul(autoSell.minPart).div( autoSell.parts ) ``` The expression `IERC20(token0).totalSupply().mul(autoSell.minPart).div(autoSell.parts)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=175 uint maxSell = IERC20(token0).totalSupply().mul(autoSell.maxPart).div( autoSell.parts ); ``` The expression `IERC20(token0).totalSupply().mul(autoSell.maxPart).div(autoSell.parts)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=185 uint amount2AddL = amount2.mul(allot.addL).div(total2Fee).div(2); ``` The expression `amount2.mul(allot.addL).div(total2Fee)` may divide by zero. Its divisor has has estimated interval [-173688133855974293135356477513031861779904976998460846059186376011869694459902, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=191 cake = amount2Marketing.mul(marketingShare[i]).div(sharetotal); ``` The expression `amount2Marketing.mul(marketingShare[i]).div(sharetotal)` may divide by zero. Its divisor has has estimated interval [0, 231584178474632390847141970017375815706539969331281128078915168015826259279870]. --- ```solidity=79 uint feeAmount= amount.mul(fee).div(fees.total); ``` The expression `amount.mul(fee).div(fees.total)` may divide by zero. Its divisor has has estimated interval [0, 115792089237316195423570985008687907853269984665640564039457584007913129639935]. --- ```solidity=121 _receiveD = address(MAXADD/ktNum); ``` The expression `MAXADD / ktNum` may divide by zero. Its divisor has has estimated interval [0, 1461501637330902918203684832716283019655932542979].

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

The linked statements(function _buy) do not affect the functionality of the codebase and appear to be either leftovers from older functionality.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=21 IRouter router; ``` - The contract `MktCap` interacts with third party contract with `IRouter` interface via `router`.

The return values of the `transfer()` and `transferFrom()` calls in the smart contract are not checked. Some ERC-20 tokens' transfer functions return no values, while others return a bool value, they should be handled with care. If a function returns `false` instead of reverting upon failure, an unchecked failed transfer could be mistakenly considered successful in the contract. ```solidity=120 IERC20(token1).transferFrom(address(_tokenDistributor),address(this), IERC20(token1).balanceOf(address(_tokenDistributor))); ``` --- ```solidity=134 IERC20(token0).transferFrom(address(_tokenDistributor),address(this), IERC20(token0).balanceOf(address(_tokenDistributor))); ``` --- ```solidity=180 if (toBurn > 0) IERC20(token0).transfer(address(0xdead), toBurn); ``` --- ```solidity=192 IERC20(token1).transfer(marketingAddress[i], cake); ``` --- ```solidity=133 else IERC20(token).transfer(dev,amount); ```

The function `setMarketing` does not check the parameter values non-zero. ```solidity function setMarketing( address[] calldata list, uint[] memory share ) public onlyOwner { require(list.length > 0, "DAO:Can't be Empty"); require(list.length == share.length, "DAO:number must be the same"); uint total = 0; for (uint i = 0; i < share.length; i++) { total = total.add(share[i]); } require(total > 0, "DAO:share must greater than zero"); marketingAddress = list; marketingShare = share; sharetotal = total; } ``` Hence in the trigger function, the cake to be transferred could be zero. However, transferring zero amount tokens in a loop can end up blocking the operation. ```soldity for (uint i = 0; i < marketingAddress.length; i++) { cake = amount2Marketing.mul(marketingShare[i]).div(sharetotal); IERC20(token1).transfer(marketingAddress[i], cake); } ``` This is a bit concerning as some ERC20 implementations revert on zero value transfers (see <https://github.com/d-xo/weird-erc20#revert-on-zero-value-transfers>). If at least one of the tokens includes this behavior, then the current implementation may cause a denial of service, as a zero amount transfer in this token will block the whole action and revert the transaction.