Findings

Issue 01

Type	Severity	Location	Status
Best Practice	Low	receive	✔️ Resolved

Description

There is a receive function in the contract, which means any address can send BNB to the contract.

Recommendation:

In order to prevent the contract from receiving BNB from investors, our recommendation is to only accept BNB from “whitelisted” addresses (e.g. the router address).

The receive function will revert if the address is not whitelisted.

Status

The issue has been resolved.

Issue 02

Type	Severity	Location	Status
Owner Capabilities	Medium	setRouterAddress	✔️ Resolved

Description

The owner can set PancakeSwap's router address, which gives him full control over all token swaps.

Recommendation

Consider implementing a timelock mechanism to allow users to review the changes, or remove this feature altogether as backward-incompatible router updates are a very rare event, and this can be implemented with the existing updateStrategy logic.

Status

The issue has been resolved.

Issue 03

Type	Severity	Location	Status
Owner Capabilities	High	blockAddress	✔️ Resolved

Description

The owner can blacklist any address anytime.

Recommendation

Consider time limiting this capability / remove this capability if not needed.

Status

The issue has been resolved.

Issue 04

Type	Severity	Location	Status
Volatile Code	High	_transfer	✔️ Resolved

Description

_transfer may call internally to swapExactTokensForETHSupportingFeeOnTransferTokens and addLiquidityETH , which may cause _transfer to fail unnecessarily.

Recommendation

_transfer should always work, and shouldn't fail if swapExactTokensForETHSupportingFeeOnTransferTokens or addLiquidityETH fail to ensure token will always be tradable.

Wrap these functions inside try-catch.

Status

The issue has been resolved.

Issue 05

Type	Severity	Location	Status
Gas Optimization	Low	_transfer	✔️ Resolved

Description

approve is being called on every transaction which automatically contributes liquidity to the pool, on the same tokens and for the same spender (the router).

Recommendation

In order to reduce gas costs, approve could be called once (with max int).

Status

The issue has been resolved.