MEDIUM severity: ZD - Zero Division. Variables used as denominators can be set to zero, leading to unpredictable results.

Vulnerable code:
// SPDX-License-Identifier: MIT



//TELEGRAM: https://t.me/Twelve_Days_Of_Xmas_BSC

//WEBSITE: https://www.12daysofxmas.info



pragma solidity 0.8.17;



library SafeMath {

    function add(uint256 a, uint256 b) internal pure returns (uint256) {

        uint256 c = a + b;

        require(c >= a, "SafeMath: addition overflow");



        return c;

    }

    function sub(uint256 a, uint256 b) internal pure returns (uint256) {

        return sub(a, b, "SafeMath: subtraction overflow");

    }

    function sub(uint256 a, uint256 b, string memory errorMessage) internal pure returns (uint256) {

        require(b <= a, errorMessage);

        uint256 c = a - b;



        return c;

    }

    function mul(uint256 a, uint256 b) internal pure returns (uint256) {

        if (a == 0) {

            return 0;

        }



        uint256 c = a * b;

        require(c / a == b, "SafeMath: multiplication overflow");



        return c;

    }

    function div(uint256 a, uint256 b) internal pure returns (uint256) {

        return div(a, b, "SafeMath: division by zero");

    }

    function div(uint256 a, uint256 b, string memory errorMessage) internal pure returns (uint256) {

        require(b > 0, errorMessage);

        uint256 c = a / b;

        return c;

    }

}



interface BEP20 {

    function getOwner() external view returns (address);

    function balanceOf(address account) external view returns (uint256);

    function transfer(address recipient, uint256 amount) external returns (bool);

    function allowance(address _owner, address spender) external view returns (uint256);

    function approve(address spender, uint256 amount) external returns (bool);

    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);

    event Transfer(address indexed from, address indexed to, uint256 value);

    event Approval(address indexed owner, address indexed spender, uint256 value);

}



abstract contract Auth {

    address internal owner;

    address internal potentialOwner;

    mapping (address => bool) internal authorizations;



    event Authorize_Wallet(address Wallet, bool Status);



    constructor(address _owner) {

        owner = _owner;

        authorizations[_owner] = true;

    }



    modifier onlyOwner() {

        require(isOwner(msg.sender), "!OWNER"); _;

    }



    function isOwner(address account) public view returns (bool) {

        return account == owner;

    }



    function transferOwnership(address  adr) external onlyOwner {

        require(adr != owner, "Already the owner");

        require(adr != address(0), "Can not be zero address.");

        potentialOwner = adr;

        emit OwnershipNominated(adr);

    }



    function acceptOwnership() external {

        require(msg.sender == potentialOwner, "You must be nominated as potential owner before you can accept the role.");

        authorizations[owner] = false;

        authorizations[potentialOwner] = true;



        emit Authorize_Wallet(owner,false);

        emit Authorize_Wallet(potentialOwner,true);

        

        owner = potentialOwner;

        potentialOwner = address(0);

        emit OwnershipTransferred(owner);

    }



    function renounceOwnership() public virtual onlyOwner {

        _transferOwnership(address(0));

    }



    function _transferOwnership(address newOwner) internal virtual {

        address oldOwner = owner;

        owner = newOwner;

        emit OwnershipRenounced(oldOwner, newOwner);

    }



    event OwnershipRenounced(address oldOwner, address newOwner);

    event OwnershipTransferred(address owner);

    event OwnershipNominated(address potentialOwner);

}



interface IDEXFactory {

    function createPair(address tokenA, address tokenB) external returns (address pair);

}



interface IDEXRouter {

    function factory() external pure returns (address);

    function WETH() external pure returns (address);



    function addLiquidityETH(

        address token,

        uint amountTokenDesired,

        uint amountTokenMin,

        uint amountETHMin,

        address to,

        uint deadline

    ) external payable returns (uint amountToken, uint amountETH, uint liquidity);



    function swapExactTokensForETHSupportingFeeOnTransferTokens(

        uint amountIn,

        uint amountOutMin,

        address[] calldata path,

        address to,

        uint deadline

    ) external;

}



contract Twelve_Days_Of_Xmas is BEP20, Auth {

    using SafeMath for uint256;



    address immutable WBNB;

    address constant DEAD = 0x000000000000000000000000000000000000dEaD;

    address constant ZERO = 0x0000000000000000000000000000000000000000;



    string public constant name = "12 Days Of Xmas";

    string public constant symbol = "DOX";

    uint8 public constant decimals = 18;



    uint256 public constant totalSupply = 100000000 * 10**decimals;



    mapping (address => uint256) public balanceOf;

    mapping (address => mapping (address => uint256)) _allowances;



    mapping (address => bool) public isFeeExempt;



    uint256 public marketingFee = 2;

    uint256 private otherFee = 2;

    uint256 public totalFee = marketingFee + otherFee;

    uint256 public constant feeDenominator = 100;



    uint256 sellMultiplier = 100;

    uint256 buyMultiplier = 100;

    uint256 transferMultiplier = 100;



    address public marketingFeeReceiver = 0x8C63e0AcE0F28e20c65c9e289aa24A1Ad57D331F;

    address private otherFeeReceiver = 0xd3692981769ba52f5969308A2A6eAfa724254bE2;



    IDEXRouter public router;

    address public immutable pair;



    bool public swapEnabled = false;

    uint256 public swapThreshold = totalSupply / 500;

    bool inSwap;

    modifier swapping() { inSwap = true; _; inSwap = false; }



    constructor () Auth(msg.sender) {

        

        router = IDEXRouter(0x10ED43C718714eb63d5aA57B78B54704E256024E); //router address pcs v2

        WBNB = router.WETH();



        pair = IDEXFactory(router.factory()).createPair(WBNB, address(this));

        _allowances[address(this)][address(router)] = type(uint256).max;

        isFeeExempt[msg.sender] = true;

        balanceOf[msg.sender] = totalSupply;

        emit Transfer(address(0), msg.sender, totalSupply);

    }



    receive() external payable { }



    function getOwner() external view override returns (address) { return owner; }

    function allowance(address holder, address spender) external view override returns (uint256) { return _allowances[holder][spender]; }



    function approve(address spender, uint256 amount) public override returns (bool) {

        _allowances[msg.sender][spender] = amount;

        emit Approval(msg.sender, spender, amount);

        return true;

    }



    function approveMax(address spender) external returns (bool) {

        return approve(spender, type(uint256).max);

    }



    function transfer(address recipient, uint256 amount) external override returns (bool) {

        return _transferFrom(msg.sender, recipient, amount);

    }



    function transferFrom(address sender, address recipient, uint256 amount) external override returns (bool) {

        if(_allowances[sender][msg.sender] != type(uint256).max){

            _allowances[sender][msg.sender] = _allowances[sender][msg.sender].sub(amount, "Insufficient Allowance");

        }



        return _transferFrom(sender, recipient, amount);

    }



    function _transferFrom(address sender, address recipient, uint256 amount) internal returns (bool) {

        if(inSwap){ return _basicTransfer(sender, recipient, amount); }

        

        if(shouldSwapBack()){ swapBack(); }



        balanceOf[sender] = balanceOf[sender].sub(amount, "Insufficient Balance");



        uint256 amountReceived = (isFeeExempt[sender] || isFeeExempt[recipient]) ? amount : takeFee(sender, amount, recipient);



        balanceOf[recipient] = balanceOf[recipient].add(amountReceived);





        emit Transfer(sender, recipient, amountReceived);

        return true;

    }

    

    function _basicTransfer(address sender, address recipient, uint256 amount) internal returns (bool) {

        balanceOf[sender] = balanceOf[sender].sub(amount, "Insufficient Balance");

        balanceOf[recipient] = balanceOf[recipient].add(amount);

        emit Transfer(sender, recipient, amount);

        return true;

    }



    function takeFee(address sender, uint256 amount, address recipient) internal returns (uint256) {

        if(amount == 0 || totalFee == 0){

            return amount;

        }



        uint256 multiplier = transferMultiplier;



        if(recipient == pair) {

            multiplier = sellMultiplier;

        } else if(sender == pair) {

            multiplier = buyMultiplier;

        }



        uint256 feeAmount = amount.mul(totalFee).mul(multiplier).div(feeDenominator * 100);



        if(feeAmount > 0){

            balanceOf[address(this)] = balanceOf[address(this)].add(feeAmount);

            emit Transfer(sender, address(this), feeAmount);

        }



        return amount.sub(feeAmount);

    }



    function shouldSwapBack() internal view returns (bool) {

        return msg.sender != pair

        && !inSwap

        && swapEnabled

        && balanceOf[address(this)] >= swapThreshold;

    }



    function swapBack() internal swapping {



        uint256 totalBNBFee = totalFee;

        uint256 amountToSwap = swapThreshold ;



        address[] memory path = new address[](2);

        path[0] = address(this);

        path[1] = WBNB;



        router.swapExactTokensForETHSupportingFeeOnTransferTokens(

            amountToSwap,

            0,

            path,

            address(this),

            block.timestamp

        );



        uint256 amountBNB = address(this).balance;

        uint256 amountBNBMarketing = (amountBNB * marketingFee) / totalBNBFee;

        uint256 amountBNBDevelopment = (amountBNB * otherFee) / totalBNBFee;



        payable(marketingFeeReceiver).transfer(amountBNBMarketing);

        payable(otherFeeReceiver).transfer(amountBNBDevelopment);



        

    }



    function manage_FeeExempt(address[] calldata addresses, bool status) external onlyOwner {

        require(addresses.length < 501,"GAS Error: max limit is 500 addresses");

        for (uint256 i=0; i < addresses.length; ++i) {

            isFeeExempt[addresses[i]] = status;

            emit Wallet_feeExempt(addresses[i], status);

        }

    }



    function update_fees() internal {



        emit UpdateFee( uint8(totalFee.mul(buyMultiplier).div(100)),

            uint8(totalFee.mul(sellMultiplier).div(100)),

            uint8(totalFee.mul(transferMultiplier).div(100))

            );

    }



     function setFees( uint256 _marketingFee,  uint256 _otherFee) external onlyOwner {

        require(_marketingFee + _otherFee <=25, " The total fee can not be more than 25%");

        marketingFee = _marketingFee;

        otherFee = _otherFee;

        totalFee = _marketingFee  + _otherFee;        

        update_fees();

    } 



    function setFeeReceivers(address _marketingFeeReceiver,  address _otherFeeReceiver) external onlyOwner {

        require(_marketingFeeReceiver != address(0),"Marketing fee address cannot be zero address");

        require(_otherFeeReceiver != address(0),"Development fee address cannot be zero address");



        marketingFeeReceiver = _marketingFeeReceiver;

        otherFeeReceiver = _otherFeeReceiver;



        emit Set_Wallets(marketingFeeReceiver,  otherFeeReceiver);

    }



    function setSwapBackSettings(bool _enabled, uint256 _amount) external onlyOwner {

        require(_amount < (totalSupply/10), "Amount too high");



        swapEnabled = _enabled;

        swapThreshold = _amount;



        emit config_SwapSettings(swapThreshold, swapEnabled);

    }

    

    function getCirculatingSupply() public view returns (uint256) {

        return (totalSupply - balanceOf[DEAD] - balanceOf[ZERO]);

    }





event AutoLiquify(uint256 amountBNB, uint256 amountTokens);

event UpdateFee(uint8 Buy, uint8 Sell, uint8 Transfer);

event Wallet_feeExempt(address Wallet, bool Status);

event Wallet_txExempt(address Wallet, bool Status);

event Wallet_holdingExempt(address Wallet, bool Status);



event BalanceClear(uint256 amount);

event clearToken(address TokenAddressCleared, uint256 Amount);



event Set_Wallets(address MarketingWallet,  address DevelopmentWallet);

event Set_Wallets_Dev(address DevWallet);



event config_MaxWallet(uint256 maxWallet);

event config_MaxTransaction(uint256 maxWallet);

event config_TradingStatus(bool Status);

event config_LaunchMode(bool Status);

event config_SwapSettings(uint256 Amount, bool Enabled);



}

Vulnerability type: CWE-682|CWE-369