Malicious Bool Checks

// DANGEROUS: Trading can be disabled at any time
bool public tradingEnabled = false;

function transfer(address to, uint256 amount) public override returns (bool) {
    require(tradingEnabled || msg.sender == owner, "Trading disabled");
    return super.transfer(to, amount);
}

function enableTrading() public onlyOwner {
    tradingEnabled = true;  // Can also be set back to false!
}

// DANGEROUS: Arbitrary blacklisting
mapping(address => bool) public blacklisted;

function transfer(address to, uint256 amount) public override returns (bool) {
    require(!blacklisted[msg.sender], "Blacklisted");
    require(!blacklisted[to], "Blacklisted recipient");
    return super.transfer(to, amount);
}

function setBlacklist(address account, bool status) public onlyOwner {
    blacklisted[account] = status;
}

// DANGEROUS: Hidden fee activation
bool public feesEnabled = false;
uint256 public feePercent = 99;  // 99% fee when enabled!

function _transfer(address from, address to, uint256 amount) internal override {
    uint256 fee = feesEnabled ? amount * feePercent / 100 : 0;
    super._transfer(from, to, amount - fee);
    if (fee > 0) super._transfer(from, feeRecipient, fee);
}

// DANGEROUS: One-way trading
bool public sellEnabled = true;

function _transfer(address from, address to, uint256 amount) internal override {
    if (to == uniswapPair) {  // Selling to DEX
        require(sellEnabled || from == owner, "Selling disabled");
    }
    super._transfer(from, to, amount);
}

// SAFE: Trading can only be enabled once
bool public tradingEnabled = false;
bool public tradingLocked = false;

function enableTrading() public onlyOwner {
    require(!tradingLocked, "Already locked");
    tradingEnabled = true;
    tradingLocked = true;  // Cannot be changed again
}

// SAFER: Timelock on blacklist changes
mapping(address => bool) public blacklisted;
mapping(address => uint256) public blacklistPending;

function proposeBlacklist(address account) public onlyOwner {
    blacklistPending[account] = block.timestamp + 2 days;
    emit BlacklistProposed(account);
}

function executeBlacklist(address account) public onlyOwner {
    require(blacklistPending[account] != 0, "Not proposed");
    require(block.timestamp >= blacklistPending[account], "Timelock");
    blacklisted[account] = true;
    emit Blacklisted(account);
}

{
  "issues": [
    {
      "tag": "trading_toggle",
      "severity": "high",
      "description": "Owner can disable trading at any time",
      "location": "enableTrading()"
    },
    {
      "tag": "sell_restriction",
      "severity": "critical",
      "description": "Selling to DEX can be blocked by owner",
      "location": "_transfer(address,address,uint256)"
    }
  ]
}