How Safe is SafeMoon? Analyzing the FETA and BEVO Exploits

This report details a DeFi exploit of the FETA token caused by a bug in reflection accounting that left ~10% of reflections untracked; the attacker used flashloans plus repeated deliver() burns and skim() calls on an unecluded DEX pair to extract value (≈10.3 WBNB profit). The vulnerability stems from failing to subtract charity reflections from rTotal, producing "shadow" reflections and enabling balance inflation; recommendation: add pair addresses to excludedFromReward and audit SafeMoon forks.