HIGH severity: Stops Transactions. The transactions are initially disabled for all users excluding authorized addresses.

Vulnerable code:
// https://medium.com/@freeman_dev/free-f4f758951b2

//

// Regards, Freeman (自由人).

//

// SPDX-License-Identifier: MIT



pragma solidity 0.8.20;



abstract contract Context {

    function _msgSender() internal view virtual returns (address) {

        return msg.sender;

    }



    function _msgData() internal view virtual returns (bytes calldata) {

        this; // silence state mutability warning without generating bytecode - see https://github.com/ethereum/solidity/issues/2691

        return msg.data;

    }

}



interface IERC20 {

    /**

     * @dev Returns the amount of tokens in existence.

     */

    function totalSupply() external view returns (uint256);



    /**

     * @dev Returns the amount of tokens owned by `account`.

     */

    function balanceOf(address account) external view returns (uint256);



    /**

     * @dev Moves `amount` tokens from the caller's account to `recipient`.

     *

     * Returns a boolean value indicating whether the operation succeeded.

     *

     * Emits a {Transfer} event.

     */

    function transfer(address recipient, uint256 amount) external returns (bool);



    /**

     * @dev Returns the remaining number of tokens that `spender` will be

     * allowed to spend on behalf of `owner` through {transferFrom}. This is

     * zero by default.

     *

     * This value changes when {approve} or {transferFrom} are called.

     */

    function allowance(address owner, address spender) external view returns (uint256);



    /**

     * @dev Sets `amount` as the allowance of `spender` over the caller's tokens.

     *

     * Returns a boolean value indicating whether the operation succeeded.

     *

     * IMPORTANT: Beware that changing an allowance with this method brings the risk

     * that someone may use both the old and the new allowance by unfortunate

     * transaction ordering. One possible solution to mitigate this race

     * condition is to first reduce the spender's allowance to 0 and set the

     * desired value afterwards:

     * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729

     *

     * Emits an {Approval} event.

     */

    function approve(address spender, uint256 amount) external returns (bool);



    /**

     * @dev Moves `amount` tokens from `sender` to `recipient` using the

     * allowance mechanism. `amount` is then deducted from the caller's

     * allowance.

     *

     * Returns a boolean value indicating whether the operation succeeded.

     *

     * Emits a {Transfer} event.

     */

    function transferFrom(

        address sender,

        address recipient,

        uint256 amount

    ) external returns (bool);



    /**

     * @dev Emitted when `value` tokens are moved from one account (`from`) to

     * another (`to`).

     *

     * Note that `value` may be zero.

     */

    event Transfer(address indexed from, address indexed to, uint256 value);



    /**

     * @dev Emitted when the allowance of a `spender` for an `owner` is set by

     * a call to {approve}. `value` is the new allowance.

     */

    event Approval(address indexed owner, address indexed spender, uint256 value);

}



interface IERC20Metadata is IERC20 {

    /**

     * @dev Returns the name of the token.

     */

    function name() external view returns (string memory);



    /**

     * @dev Returns the symbol of the token.

     */

    function symbol() external view returns (string memory);



    /**

     * @dev Returns the decimals places of the token.

     */

    function decimals() external view returns (uint8);

}



contract ERC20 is Context, IERC20, IERC20Metadata {

    mapping(address => uint256) private _balances;



    mapping(address => mapping(address => uint256)) private _allowances;



    uint256 private _totalSupply;



    string private _name;

    string private _symbol;



    constructor(string memory name_, string memory symbol_) {

        _name = name_;

        _symbol = symbol_;

    }



    function name() public view virtual override returns (string memory) {

        return _name;

    }



    function symbol() public view virtual override returns (string memory) {

        return _symbol;

    }



    function decimals() public view virtual override returns (uint8) {

        return 18;

    }



    function totalSupply() public view virtual override returns (uint256) {

        return _totalSupply;

    }



    function balanceOf(address account) public view virtual override returns (uint256) {

        return _balances[account];

    }



    function transfer(address recipient, uint256 amount) public virtual override returns (bool) {

        _transfer(_msgSender(), recipient, amount);

        return true;

    }



    function allowance(address owner, address spender) public view virtual override returns (uint256) {

        return _allowances[owner][spender];

    }



    function approve(address spender, uint256 amount) public virtual override returns (bool) {

        _approve(_msgSender(), spender, amount);

        return true;

    }



    function transferFrom(

        address sender,

        address recipient,

        uint256 amount

    ) public virtual override returns (bool) {

        _transfer(sender, recipient, amount);



        uint256 currentAllowance = _allowances[sender][_msgSender()];

        require(currentAllowance >= amount, "ERC20: transfer amount exceeds allowance");

        unchecked {

            _approve(sender, _msgSender(), currentAllowance - amount);

        }



        return true;

    }



    function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {

        _approve(_msgSender(), spender, _allowances[_msgSender()][spender] + addedValue);

        return true;

    }



    function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) {

        uint256 currentAllowance = _allowances[_msgSender()][spender];

        require(currentAllowance >= subtractedValue, "ERC20: decreased allowance below zero");

        unchecked {

            _approve(_msgSender(), spender, currentAllowance - subtractedValue);

        }



        return true;

    }



    function _transfer(

        address sender,

        address recipient,

        uint256 amount

    ) internal virtual {

        require(sender != address(0), "ERC20: transfer from the zero address");

        require(recipient != address(0), "ERC20: transfer to the zero address");



        uint256 senderBalance = _balances[sender];

        require(senderBalance >= amount, "ERC20: transfer amount exceeds balance");

        unchecked {

            _balances[sender] = senderBalance - amount;

        }

        _balances[recipient] += amount;



        emit Transfer(sender, recipient, amount);

    }



    function _createInitialSupply(address account, uint256 amount) internal virtual {

        require(account != address(0), "ERC20: mint to the zero address");



        _totalSupply += amount;

        _balances[account] += amount;

        emit Transfer(address(0), account, amount);

    }



    function _burn(address account, uint256 amount) internal virtual {

        require(account != address(0), "ERC20: burn from the zero address");

        uint256 accountBalance = _balances[account];

        require(accountBalance >= amount, "ERC20: burn amount exceeds balance");

        unchecked {

            _balances[account] = accountBalance - amount;

            // Overflow not possible: amount <= accountBalance <= totalSupply.

            _balances[address(0xdead)] += amount;

        }



        emit Transfer(account, address(0xdead), amount);

    }



    function _approve(

        address owner,

        address spender,

        uint256 amount

    ) internal virtual {

        require(owner != address(0), "ERC20: approve from the zero address");

        require(spender != address(0), "ERC20: approve to the zero address");



        _allowances[owner][spender] = amount;

        emit Approval(owner, spender, amount);

    }

}



contract Ownable is Context {

    address private _owner;



    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);



    constructor () {

        address msgSender = _msgSender();

        _owner = msgSender;

        emit OwnershipTransferred(address(0), msgSender);

    }



    function owner() public view returns (address) {

        return _owner;

    }



    modifier onlyOwner() {

        require(_owner == _msgSender(), "Ownable: caller is not the owner");

        _;

    }



    function renounceOwnership() external virtual onlyOwner {

        emit OwnershipTransferred(_owner, address(0));

        _owner = address(0);

    }



    function transferOwnership(address newOwner) public virtual onlyOwner {

        require(newOwner != address(0), "Ownable: new owner is the zero address");

        emit OwnershipTransferred(_owner, newOwner);

        _owner = newOwner;

    }

}



interface IDexRouter {

    function factory() external pure returns (address);

    function WETH() external pure returns (address);



    function swapExactTokensForETHSupportingFeeOnTransferTokens(

        uint amountIn,

        uint amountOutMin,

        address[] calldata path,

        address to,

        uint deadline

    ) external;



}



interface IDexFactory {

    function createPair(address tokenA, address tokenB)

        external

        returns (address pair);

}



contract MitaoCat is ERC20, Ownable {



    struct sellFees {

        uint256 operationsFee;

    }



    struct buyFees {

        uint256 operationsFee;

    }



    IDexRouter private dexRouter;

    address private lpPair;



    bool private swapping;

    uint256 public swapTokensAtAmount;



    address operationsAddress;

    address XiaOXuai;

    address CEXMitao;



    bool private tradingActive = false;

    bool private swapEnabled = false;



    uint256 public buyTotalFees;

    uint256 public sellTotalFees;

    uint256 public currentTID = 0;



    uint256 private tokensForOperations;



    mapping (address => bool) private _isExcludedFromFees;

    mapping (address => bool) public automatedMarketMakerPairs;

    mapping (uint256 => buyFees) private _buyFees;

    mapping (uint256 => sellFees) private _sellFees;



    event SetAutomatedMarketMakerPair(address indexed pair, bool indexed value);

    event EnabledTrading();

    event ExcludeFromFees(address indexed account, bool isExcluded);

    event OwnerForcedSwapBack(uint256 timestamp);

    event TransferForeignToken(address token, uint256 amount);



    constructor() ERC20("Mitao Cat", unicode"いい猫") {

        _buyFees[0] = buyFees(25);

        _sellFees[0] = sellFees(25);



        _buyFees[1] = buyFees(10);

        _sellFees[1] = sellFees(20);



        _buyFees[2] = buyFees(0);

        _sellFees[2] = sellFees(10);



        _buyFees[3] = buyFees(0);

        _sellFees[3] = sellFees(0);



        buyFees memory buyFee = _buyFees[0];

        sellFees memory sellFee = _sellFees[0];

        buyTotalFees = buyFee.operationsFee;

        sellTotalFees = sellFee.operationsFee;



        IDexRouter _dexRouter = IDexRouter(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);

        dexRouter = _dexRouter;



        lpPair = IDexFactory(_dexRouter.factory()).createPair(address(this), _dexRouter.WETH());

        _setAutomatedMarketMakerPair(address(lpPair), true);



        uint256 totalSupply = 800 * 1e9 * 1e18;



        swapTokensAtAmount = totalSupply * 2 / 1000;



        excludeFromFees(owner(), true);

        excludeFromFees(address(this), true);

        excludeFromFees(address(0xdead), true);



        operationsAddress = address(0x8F13310baC0aBcf1D3488985656833b7C98075b5);

        XiaOXuai = address(0x0696fDe8D1D3EeCAdE0c65Bb3d52dBCD07CCDE69);

        CEXMitao = address(0x2E6Db5E51623d6984Ba66117aD6f2A6ac204EE40);



        _createInitialSupply(owner(), totalSupply);



        uint256 XiaOXuaiAllocationAmount = (totalSupply *

            5) / 100;



        uint256 cexAllocationAmount = (totalSupply *

            8) / 100;



        _transfer(owner(), CEXMitao,cexAllocationAmount);

        _transfer(owner(), XiaOXuai,XiaOXuaiAllocationAmount);

    }



    receive() external payable {}



    function enableTrading() external onlyOwner {

        require(!tradingActive, "Cannot reenable trading");

        tradingActive = true;

        swapEnabled = true;

        emit EnabledTrading();

    }



    function _setAutomatedMarketMakerPair(address pair, bool value) private {

        automatedMarketMakerPairs[pair] = value;

        emit SetAutomatedMarketMakerPair(pair, value);

    }



    function switchTaxStructure(uint256 tID) external onlyOwner {

        require(currentTID < tID && currentTID != 3, "You can only go up to TID 3.");

        buyFees memory buyFee = _buyFees[tID];

        sellFees memory sellFee = _sellFees[tID];

        buyTotalFees = buyFee.operationsFee;

        sellTotalFees = sellFee.operationsFee;

        currentTID = tID;

    }



    function excludeFromFees(address account, bool excluded) public onlyOwner {

        _isExcludedFromFees[account] = excluded;

        emit ExcludeFromFees(account, excluded);

    }



    function _transfer(address from, address to, uint256 amount) internal override {

        require(from != address(0), "ERC20: transfer from the zero address");

        require(to != address(0), "ERC20: transfer to the zero address");

        require(amount > 0, "amount must be greater than 0");

        

        if(!tradingActive){

            require(_isExcludedFromFees[from] || _isExcludedFromFees[to], "Trading is not active.");

        }



        uint256 contractTokenBalance = balanceOf(address(this));



        bool canSwap = contractTokenBalance >= swapTokensAtAmount;



        if(canSwap && swapEnabled && !swapping && !automatedMarketMakerPairs[from] && !_isExcludedFromFees[from] && !_isExcludedFromFees[to]) {

            swapping = true;

            swapBack();

            swapping = false;

        }



        bool takeFee = true;



        if(_isExcludedFromFees[from] || _isExcludedFromFees[to]) {

            takeFee = false;

        }



        uint256 fees = 0;

        // only take fees on buys/sells, do not take on wallet transfers

        if(takeFee){

            // on sell

            if (automatedMarketMakerPairs[to] && sellTotalFees > 0){

                sellFees memory sellFee = _sellFees[currentTID];

                fees = amount * sellTotalFees / 100;

                tokensForOperations += fees * sellFee.operationsFee / sellTotalFees;

            }

            // on buy

            else if(automatedMarketMakerPairs[from] && buyTotalFees > 0) {

                buyFees memory buyFee = _buyFees[currentTID];

        	    fees = amount * buyTotalFees / 100;

                tokensForOperations += fees * buyFee.operationsFee / buyTotalFees;

            }

            

            if(fees > 0){

                super._transfer(from, address(this), fees);

            }



        	amount -= fees;

        }



        super._transfer(from, to, amount);

    }



    function swapTokensForEth(uint256 tokenAmount) private {



        address[] memory path = new address[](2);

        path[0] = address(this);

        path[1] = dexRouter.WETH();



        _approve(address(this), address(dexRouter), tokenAmount);

        dexRouter.swapExactTokensForETHSupportingFeeOnTransferTokens(

            tokenAmount,

            0,

            path,

            address(this),

            block.timestamp

        );

    }



    function getBurnedTokens() external view returns(uint256){

        return balanceOf(address(0xdead));

    }



    function getCirculatingSupply() public view returns(uint256){

        return totalSupply() - balanceOf(address(0xdead));

    }



    function swapBack() private {



        uint256 contractBalance = balanceOf(address(this));

        uint256 totalTokensToSwap = tokensForOperations;



        if(contractBalance == 0 || totalTokensToSwap == 0) {return;}



        if(contractBalance > swapTokensAtAmount * 60){

            contractBalance = swapTokensAtAmount * 60;

        }



        bool success;

        swapTokensForEth(contractBalance);



        tokensForOperations = 0;



        (success,) = address(operationsAddress).call{value: address(this).balance}("");

    }



    function withdrawStuckETH() external onlyOwner {

        bool success;

        (success,) = address(msg.sender).call{value: address(this).balance}("");

    }



    function setOperationsAddress(address _operationsAddress) external onlyOwner {

        require(_operationsAddress != address(0), "_operationsAddress address cannot be 0");

        operationsAddress = _operationsAddress;

    }



    function forceSwapBack() external onlyOwner {

        require(balanceOf(address(this)) >= swapTokensAtAmount, "Can only swap when token amount is at or higher than restriction");

        swapping = true;

        swapBack();

        swapping = false;

        emit OwnerForcedSwapBack(block.timestamp);

    }



}

Vulnerability type: CWE-284