HIGH severity: Z123 — After each swap, it destroys liquidity. Good people, a lot of them have been destroyed. Isn't this more and more replacements? The code is on this line, destroying liquidity and raising prices. // First, tokens are exchanged from a pool with normal ratios using USD. // Then, each subsequent swap burns liquidity from the pool, resulting in disproportionate token ratios that can be exploited for arbitrage.. https://hackfor.fun/z123-exploit-analysis-015b80672cde41f4bcfe53a618295b91

Vulnerable code:
function swapExactTokensForTokensSupportingFeeOnTransferTokens(uint256 amountIn, uint256 amountOutMin, address;
    v20 = 0;
    while (v20 < 0) {
        MEM[v20 + v19.data] = MEM[v20 + (32 + MEM[64])];
        v20 += 32;
    }
    v21 = v19.data;
    if (0) {
        MEM[v19.data] = ~0x0 & MEM[v19.data];
    }
    require(bool(_swapExactTokensForTokensSupportingFeeOnTransferTokens.code.size));
    v22 = _swapExactTokensForTokensSupportingFeeOnTransferTokens.call(uint32(0xb6b4c488), v14, v14, to, v12, v19).gas(msg.gas);
    require(bool(v22), 0, RETURNDATASIZE()); // checks call status, propagates error data on error
    require(bool((address(v0[0x1])).code.size));
    v23, /* uint256 */ v24 = address(v0[0x1]).balanceOf(to).gas(msg.gas);
    require(bool(v23), 0, RETURNDATASIZE()); // checks call status, propagates error data on error
    v25 = 0x536166654d6174683a207375627472616374696f6e206f766572666c6f770000fff6cae900000000000000000000000000000000000000000000000000000000;
    require(RETURNDATASIZE() >= 32);
    if (v18 <= v25.length) {
        if (v25.length - v18 >= amountOutMin) {
            if (deadline >= block.timestamp) {
                MEM[4 + MEM[64]] = _swapExactTokensForTokensSupportingFeeOnTransferTokens;
                require(bool(_setToken.code.size));
                v26 = _setToken.update(_swapExactTokensForTokensSupportingFeeOnTransferTokens, v3).gas(msg.gas);
                require(bool(v26), 0, RETURNDATASIZE()); // checks call status, propagates error data on error
                require(bool(_swapExactTokensForTokensSupportingFeeOnTransferTokens.code.size));
                v27 = _swapExactTokensForTokensSupportingFeeOnTransferTokens.sync().gas(msg.gas);
                require(bool(v27), 0, RETURNDATASIZE()); // checks call status, propagates error data on error
                stor_1_0_0 = 1;
                exit;
            } else {
                MEM[MEM[64] + 4] = 32;
                revert(Error('QiaoswapV2Router: EXPIRED'));
            }
        } else {
            MEM[4 + MEM[64]] = 32;
            revert(Error('QiaoswapV2Router: INSUFFICIENT_OUTPUT_AMOUNT', v28, v28, 0));
        }
    } else {
        MEM[MEM[64] + 4] = 32;
        v29 = new bytes[](v25.length);
        if (v25.length) {
            v30 = v25.data;
            v31 = v29.data;
            v29[0] = v25[0];
            v32 = v33 = 32;
            while (v32 < v25.length) {
                v29[v32] = v25[v32];
                v32 += 32;
            }
        }
        if (30) {
            MEM[v29.data] = ~0xffff & MEM[v29.data];
        }
        revert(Error(v29, v28, v28, 0));
    }
}

Vulnerability type: Business Logic Flaw, Price Manipulation