HIGH severity: ZD - Zero Division. Potential for zero division in contract, leading to unpredictable behavior.

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED



/*



TELEGRAM: 

https://t.me/torwalletapp



WEBSITE: 

https://torwallet.app/



*/





pragma solidity 0.8.18;



library SafeMath {

    function add(uint256 a, uint256 b) internal pure returns (uint256) {

        uint256 c = a + b;

        require(c >= a, "SafeMath: addition overflow");



        return c;

    }

    function sub(uint256 a, uint256 b) internal pure returns (uint256) {

        return sub(a, b, "SafeMath: subtraction overflow");

    }

    function sub(uint256 a, uint256 b, string memory errorMessage) internal pure returns (uint256) {

        require(b <= a, errorMessage);

        uint256 c = a - b;



        return c;

    }

    function mul(uint256 a, uint256 b) internal pure returns (uint256) {

        if (a == 0) {

            return 0;

        }



        uint256 c = a * b;

        require(c / a == b, "SafeMath: multiplication overflow");



        return c;

    }

    function div(uint256 a, uint256 b) internal pure returns (uint256) {

        return div(a, b, "SafeMath: division by zero");

    }

    function div(uint256 a, uint256 b, string memory errorMessage) internal pure returns (uint256) {

        require(b > 0, errorMessage);

        uint256 c = a / b;

        return c;

    }

}



interface BEP20 {

    function totalSupply() external view returns (uint256);

    function decimals() external view returns (uint8);

    function symbol() external view returns (string memory);

    function name() external view returns (string memory);    function getOwner() external view returns (address);

    function balanceOf(address account) external view returns (uint256);

    function transfer(address recipient, uint256 amount) external returns (bool);

    function allowance(address _owner, address spender) external view returns (uint256);

    function approve(address spender, uint256 amount) external returns (bool);

    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);

    event Transfer(address indexed from, address indexed to, uint256 value);

    event Approval(address indexed owner, address indexed spender, uint256 value);

}



abstract contract Auth {

    address internal owner;

    address internal potentialOwner;

    mapping (address => bool) internal authorizations;



    event Authorize_Wallet(address Wallet, bool Status);



    event OwnershipRenounced(address indexed previousOwner);



    event OwnershipTransferred(

        address indexed previousOwner,

        address indexed newOwner

    );





    constructor(address _owner) {

        owner = _owner;

        authorizations[_owner] = true;

    }



    modifier onlyOwner() {

        require(isOwner(msg.sender), "!OWNER"); _;

    }



    modifier authorized() {

        require(isAuthorized(msg.sender), "!AUTHORIZED"); _;

    }



    function authorize(address adr) external onlyOwner {

        authorizations[adr] = true;

        emit Authorize_Wallet(adr,true);

    }



    function unauthorize(address adr) external onlyOwner {

        require(adr != owner, "OWNER cant be unauthorized");

        authorizations[adr] = false;

        emit Authorize_Wallet(adr,false);

    }



    function isOwner(address account) public view returns (bool) {

        return account == owner;

    }



    function isAuthorized(address adr) public view returns (bool) {

        return authorizations[adr];

    }



    function renounceOwnership() public onlyOwner {

        emit OwnershipRenounced(owner);

        owner = address(0);

    }



    function transferOwnership(address newOwner) public onlyOwner {

        _transferOwnership(newOwner);

    }



    function _transferOwnership(address newOwner) internal {

        require(newOwner != address(0));

        emit OwnershipTransferred(owner, newOwner);

        owner = newOwner;

    }

}



interface IDEXFactory {

    function createPair(address tokenA, address tokenB) external returns (address pair);

}



interface IDEXRouter {

    function factory() external pure returns (address);

    function WETH() external pure returns (address);



    function addLiquidity(

        address tokenA,

        address tokenB,

        uint amountADesired,

        uint amountBDesired,

        uint amountAMin,

        uint amountBMin,

        address to,

        uint deadline

    ) external returns (uint amountA, uint amountB, uint liquidity);



    function addLiquidityETH(

        address token,

        uint amountTokenDesired,

        uint amountTokenMin,

        uint amountETHMin,

        address to,

        uint deadline

    ) external payable returns (uint amountToken, uint amountETH, uint liquidity);



    function swapExactTokensForTokensSupportingFeeOnTransferTokens(

        uint amountIn,

        uint amountOutMin,

        address[] calldata path,

        address to,

        uint deadline

    ) external;



    function swapExactETHForTokensSupportingFeeOnTransferTokens(

        uint amountOutMin,

        address[] calldata path,

        address to,

        uint deadline

    ) external payable;



    function swapExactTokensForETHSupportingFeeOnTransferTokens(

        uint amountIn,

        uint amountOutMin,

        address[] calldata path,

        address to,

        uint deadline

    ) external;

}



interface InterfaceLP {

    function sync() external;

}



contract TorWallet is BEP20, Auth {

    using SafeMath for uint256;



    address immutable WBNB;

    address constant DEAD = 0x000000000000000000000000000000000000dEaD;

    address constant ZERO = 0x0000000000000000000000000000000000000000;



    string constant _name = "Tor Wallet";

    string constant _symbol = "TOR";

    uint8 constant _decimals = 18;



    uint256 public _totalSupply = 1 * 10**7 * 10**_decimals;



    uint256 public _maxTxAmount = _totalSupply / 100; // 1%

    uint256 public _maxWalletToken = _totalSupply / 50; // 2%



    mapping (address => uint256) public balanceOf;

    mapping (address => mapping (address => uint256)) _allowances;



    mapping (address => bool) public isFeeExempt;

    mapping (address => bool) public isTxLimitExempt;

    mapping (address => bool) public isWalletLimitExempt;



    uint256 public liquidityFee = 0;

    uint256 public marketingFee = 0;

    uint256 public buybackFee = 0;

    uint256 public burnFee = 0;

    uint256 public totalFee = marketingFee + liquidityFee + buybackFee + burnFee;

    uint256 public constant feeDenominator = 1000;



    uint256 sellMultiplier = 100;

    uint256 buyMultiplier = 100;

    uint256 transferMultiplier = 25;



    address public marketingFeeReceiver;

    address public buybackFeeReceiver;



    IDEXRouter public router;

    address public immutable pair;



    InterfaceLP public pairContract;

    uint256 public lastSync;



    bool public tradingOpen = false;

    bool public burnEnabled = false;

    uint256 public launchedAt;



    bool public swapEnabled = true;

    uint256 public swapThreshold = _totalSupply / 1000;

    bool inSwap;

    modifier swapping() { inSwap = true; _; inSwap = false; }



    constructor () Auth(msg.sender) {

        router = IDEXRouter(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);

        //router = IDEXRouter(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D); testnet

        WBNB = router.WETH();



        pair = IDEXFactory(router.factory()).createPair(WBNB, address(this));

        pairContract = InterfaceLP(pair);

        lastSync = block.timestamp;



        _allowances[address(this)][address(router)] = type(uint256).max;



        marketingFeeReceiver = msg.sender;

        buybackFeeReceiver = msg.sender;



        isFeeExempt[msg.sender] = true;



        isTxLimitExempt[msg.sender] = true;

        isTxLimitExempt[DEAD] = true;

        isTxLimitExempt[ZERO] = true;



        isWalletLimitExempt[msg.sender] = true;

        isWalletLimitExempt[address(this)] = true;

        isWalletLimitExempt[DEAD] = true;



        balanceOf[msg.sender] = _totalSupply;

        emit Transfer(address(0), msg.sender, _totalSupply);

    }



    receive() external payable { }



    function totalSupply() external view override returns (uint256) { return _totalSupply; }

    function decimals() external pure override returns (uint8) { return _decimals; }

    function symbol() external pure override returns (string memory) { return _symbol; }

    function name() external pure override returns (string memory) { return _name; }   function getOwner() external view override returns (address) { return owner; }

    function allowance(address holder, address spender) external view override returns (uint256) { return _allowances[holder][spender]; }



    function approve(address spender, uint256 amount) public override returns (bool) {

        _allowances[msg.sender][spender] = amount;

        emit Approval(msg.sender, spender, amount);

        return true;

    }



    function approveMax(address spender) external returns (bool) {

        return approve(spender, type(uint256).max);

    }



    function transfer(address recipient, uint256 amount) external override returns (bool) {

        return _transferFrom(msg.sender, recipient, amount);

    }



    function transferFrom(address sender, address recipient, uint256 amount) external override returns (bool) {

        if(_allowances[sender][msg.sender] != type(uint256).max){

            _allowances[sender][msg.sender] = _allowances[sender][msg.sender].sub(amount, "Insufficient Allowance");

        }



        return _transferFrom(sender, recipient, amount);

    }



    function setMaxWalletPercent_base10000(uint256 maxWallPercent_base10000) external onlyOwner {

        require(maxWallPercent_base10000 >= 10,"Cannot set max wallet less than 0.1%");

        _maxWalletToken = (_totalSupply * maxWallPercent_base10000 ) / 10000;

        emit config_MaxWallet(_maxWalletToken);

    }

    function setMaxTxPercent_base10000(uint256 maxTXPercentage_base10000) external onlyOwner {

        require(maxTXPercentage_base10000 >= 10,"Cannot set max transaction less than 0.1%");

        _maxTxAmount = (_totalSupply * maxTXPercentage_base10000 ) / 10000;

        emit config_MaxTransaction(_maxTxAmount);

    }



    function _transferFrom(address sender, address recipient, uint256 amount) internal returns (bool) {

        if(inSwap){ return _basicTransfer(sender, recipient, amount); }



        if(!authorizations[sender] && !authorizations[recipient]){

            require(tradingOpen,"Trading not open yet");

        }



        if (!authorizations[sender] && !isWalletLimitExempt[sender] && !isWalletLimitExempt[recipient] && recipient != pair) {

            require((balanceOf[recipient] + amount) <= _maxWalletToken,"max wallet limit reached");

        }

    

        // Checks max transaction limit

        require((amount <= _maxTxAmount) || isTxLimitExempt[sender] || isTxLimitExempt[recipient], "Max TX Limit Exceeded");



        if(shouldSwapBack()){ swapBack(); }



        balanceOf[sender] = balanceOf[sender].sub(amount, "Insufficient Balance");



        uint256 amountReceived = (isFeeExempt[sender] || isFeeExempt[recipient]) ? amount : takeFee(sender, amount, recipient);



        balanceOf[recipient] = balanceOf[recipient].add(amountReceived);





        emit Transfer(sender, recipient, amountReceived);

        return true;

    }

    

    function _basicTransfer(address sender, address recipient, uint256 amount) internal returns (bool) {

        balanceOf[sender] = balanceOf[sender].sub(amount, "Insufficient Balance");

        balanceOf[recipient] = balanceOf[recipient].add(amount);

        emit Transfer(sender, recipient, amount);

        return true;

    }



    function takeFee(address sender, uint256 amount, address recipient) internal returns (uint256) {

        if(amount == 0 || totalFee == 0){

            return amount;

        }



        uint256 multiplier = transferMultiplier;



        if(recipient == pair) {

            multiplier = sellMultiplier;

        } else if(sender == pair) {

            multiplier = buyMultiplier;

        }



        uint256 feeAmount = amount.mul(totalFee).mul(multiplier).div(feeDenominator * 100);

        uint256 burnTokens = feeAmount.mul(burnFee).div(totalFee);

        uint256 contractTokens = feeAmount.sub(burnTokens);



        if(contractTokens > 0){

            balanceOf[address(this)] = balanceOf[address(this)].add(contractTokens);

            emit Transfer(sender, address(this), contractTokens);

        }

        

        if(burnTokens > 0){

            _totalSupply = _totalSupply.sub(burnTokens);

            emit Transfer(sender, ZERO, burnTokens);  

        }



        return amount.sub(feeAmount);

    }



    function shouldSwapBack() internal view returns (bool) {

        return msg.sender != pair

        && !inSwap

        && swapEnabled

        && balanceOf[address(this)] >= swapThreshold;

    }



    function clearStuckToken(address tokenAddress, uint256 tokens) external authorized returns (bool success) {

        require(tokenAddress != address(this),"Cannot withdraw native token");

        if(tokenAddress == pair){

            require(block.timestamp > launchedAt + 500 days,"Locked for 1 year");

        }



        if(tokens == 0){

            tokens = BEP20(tokenAddress).balanceOf(address(this));

        }



        emit clearToken(tokenAddress, tokens);



        return BEP20(tokenAddress).transfer(msg.sender, tokens);

    }



    // switch Trading

    function tradingEnable() external onlyOwner {

        require(!tradingOpen,"Trading already open");

        tradingOpen = true;

        launchedAt = block.timestamp;

        emit config_TradingStatus(tradingOpen);

    }



    function disableBurns() external onlyOwner {

        burnEnabled = false;

    }



    function enableBurns() external onlyOwner {

        burnEnabled = true;

    }



    function swapBack() internal swapping {



        uint256 totalETHFee = totalFee - burnFee;



        uint256 amountToLiquify = (swapThreshold * liquidityFee)/(totalETHFee * 2);

        uint256 amountToSwap = swapThreshold - amountToLiquify;



        address[] memory path = new address[](2);

        path[0] = address(this);

        path[1] = WBNB;



        router.swapExactTokensForETHSupportingFeeOnTransferTokens(

            amountToSwap,

            0,

            path,

            address(this),

            block.timestamp

        );



        uint256 amountBNB = address(this).balance;



         totalETHFee = totalETHFee - (liquidityFee / 2);

        

        uint256 amountBNBLiquidity = (amountBNB * liquidityFee) / (totalETHFee * 2);

        uint256 amountBNBMarketing = (amountBNB * marketingFee) / totalETHFee;

        uint256 amountBNBbuyback = (amountBNB * buybackFee) / totalETHFee;



        payable(marketingFeeReceiver).transfer(amountBNBMarketing);

        payable(buybackFeeReceiver).transfer(amountBNBbuyback);



        if(amountToLiquify > 0){

            router.addLiquidityETH{value: amountBNBLiquidity}(

                address(this),

                amountToLiquify,

                0,

                0,

                address(this),

                block.timestamp

            );

            emit AutoLiquify(amountBNBLiquidity, amountToLiquify);

        }

    }



    function manage_FeeExempt(address[] calldata addresses, bool status) external authorized {

        require(addresses.length < 501,"GAS Error: max limit is 500 addresses");

        for (uint256 i=0; i < addresses.length; ++i) {

            isFeeExempt[addresses[i]] = status;

            emit Wallet_feeExempt(addresses[i], status);

        }

    }



    function manage_TxLimitExempt(address[] calldata addresses, bool status) external authorized {

        require(addresses.length < 501,"GAS Error: max limit is 500 addresses");

        for (uint256 i=0; i < addresses.length; ++i) {

            isTxLimitExempt[addresses[i]] = status;

            emit Wallet_txExempt(addresses[i], status);

        }

    }



    function manage_WalletLimitExempt(address[] calldata addresses, bool status) external authorized {

        require(addresses.length < 501,"GAS Error: max limit is 500 addresses");

        for (uint256 i=0; i < addresses.length; ++i) {

            isWalletLimitExempt[addresses[i]] = status;

            emit Wallet_holdingExempt(addresses[i], status);

        }

    }



    function update_fees() internal {

        require(totalFee.mul(buyMultiplier).div(100) <= 150, "Buy tax cannot be more than 15%");

        require(totalFee.mul(sellMultiplier).div(100) <= 150, "Sell tax cannot be more than 15%");

        require(totalFee.mul(sellMultiplier + buyMultiplier).div(100) <= 200, "Buy+Sell tax cannot be more than 20%");

        require(totalFee.mul(transferMultiplier).div(100) <= 100, "Transfer Tax cannot be more than 10%");



        emit UpdateFee( uint8(totalFee.mul(buyMultiplier).div(100)),

            uint8(totalFee.mul(sellMultiplier).div(100)),

            uint8(totalFee.mul(transferMultiplier).div(100))

            );

    }



    function setMultipliers(uint256 _buy, uint256 _sell, uint256 _trans) external authorized {

        sellMultiplier = _sell;

        buyMultiplier = _buy;

        transferMultiplier = _trans;



        update_fees();

    }



    function setFees_base1000(uint256 _liquidityFee,  uint256 _marketingFee, uint256 _buybackFee, uint256 _burnFee) external onlyOwner {

        liquidityFee = _liquidityFee;

        marketingFee = _marketingFee;

        buybackFee = _buybackFee;

        burnFee = _burnFee;

        totalFee = _liquidityFee + _marketingFee + _buybackFee + _burnFee;

        

        update_fees();

    }



    function setFeeReceivers(address _marketingFeeReceiver, address _buybackFeeReceiver) external onlyOwner {

        require(_marketingFeeReceiver != address(0),"Marketing fee address cannot be zero address");

        require(_buybackFeeReceiver != address(0),"buyback fee address cannot be zero address");



        marketingFeeReceiver = _marketingFeeReceiver;

        buybackFeeReceiver = _buybackFeeReceiver;



        emit Set_Wallets(marketingFeeReceiver, buybackFeeReceiver);

    }



    function setSwapBackSettings(bool _enabled, uint256 _amount) external onlyOwner {

        require(_amount >= 1 * 10**_decimals, "Amount is less than one token");

        require(_amount < (_totalSupply/10), "Amount too high");



        swapEnabled = _enabled;

        swapThreshold = _amount;



        emit config_SwapSettings(swapThreshold, swapEnabled);

    }

    

    function getCirculatingSupply() public view returns (uint256) {

        return (_totalSupply - balanceOf[DEAD] - balanceOf[ZERO]);

    }

/*

    function LPBurn(uint256 percent_base10000) public authorized returns (bool){

        require(percent_base10000 <= 1000, "May not nuke more than 10% of tokens in LP");

        require(block.timestamp > lastSync + 5 minutes, "Too soon");

        require(burnEnabled,"Burns are disabled");



        uint256 lp_tokens = this.balanceOf(pair);

        uint256 lp_burn = lp_tokens.mul(percent_base10000).div(10_000);



        if (lp_burn > 0){

            _basicTransfer(pair,DEAD,lp_burn);

            pairContract.sync();

            return true;

        }



        return false;

    }   

*/



event AutoLiquify(uint256 amountBNB, uint256 amountTokens);

event UpdateFee(uint8 Buy, uint8 Sell, uint8 Transfer);

event Wallet_feeExempt(address Wallet, bool Status);

event Wallet_txExempt(address Wallet, bool Status);

event Wallet_holdingExempt(address Wallet, bool Status);

event Wallet_blacklist(address Wallet, bool Status);



event BalanceClear(uint256 amount);

event clearToken(address TokenAddressCleared, uint256 Amount);



event Set_Wallets(address MarketingWallet, address buybackWallet);



event config_MaxWallet(uint256 maxWallet);

event config_MaxTransaction(uint256 maxWallet);

event config_TradingStatus(bool Status);

event config_LaunchMode(bool Status);

event config_BlacklistMode(bool Status);

event config_SwapSettings(uint256 Amount, bool Enabled);



}

Vulnerability type: CWE-682|CWE-369