Two permanent, near-zero-cost attacks exist against any target user. Attack A exploits the free register() function at lines 321–350 which requires zero USDT. An attacker creates 1,000 sybil addresses and registers each under the target sponsor, filling directs[sponsor] to MAX_DIRECTS = 1000 checked at line 331. Cost on Polygon is approximately $1–2 in gas. Once full, the target sponsor can never accept new referrals permanently. Each sybil registration also injects $15 airdrop to the sybil (line 338) and $1 credits to 15 upline levels (lines 341–344), creating unbacked token obligations. Attack B exploits _markOldPackagesIneligible(beneficiary) at line 396, called inside every buyPackageUnified() execution. The attacker — who must have purchased at least one package themselves to pass _isActive(payer) at line 374 (minimum practical cost $1–$50 depending on LP processing thresholds) — calls buyPackageUnified(target, 1) with a dust amount. Lines 525–532 then iterate all of the target's packages setting gnzMultiplierEligible = false for any not yet activated. The target's packages permanently lose the GNZ multiplier, dropping their daily token unlock rate from 1% to 0.3% — a 3.33× reduction that cannot be reversed.

Four compounding code-level defects create structural insolvency. First, _calculateTokens(base, price) at line 394 uses base — the full nominal package value including airdrop discount — so a user paying $85 USDT with a $15 airdrop receives tokens allocated for $100. At minimum price $0.03, one $100,000 package allocates 6,666,667 GNZ, and totalTokensAllocated at line 546 is never compared against token.balanceOf(address(this)) at purchase time, allowing unlimited over-commitment. Second, incomeBase = base - air at line 383 does not subtract genZ, so _distributeDifferential() at lines 414–418 distributes income as if the GenZ wallet credit were fresh external USDT, when it is recycled from the prior withdrawal's 40% cycle credit at line 797. Third, _createPackage() at line 398 stores incomeBase (not usdtRequired, the actual USDT transferred) as actualUsdtPaid, so GNZ multiplier sponsor rewards at line 656 are calculated on an overstated figure. Fourth, _checkAndAllocateTierRewards() at line 961 writes u.rewardTotal += rewardAmount directly — committing up to $134,300 per Tier-6 user with zero USDT deposit or reserve, requiring 19.2× that user's own deposit from others to service.

cachedPrice at line 497 updates only on successful purchases. If the GNZ market moves more than 50% from the last cached value during any purchase lull, require(priceDiff <= maxDiff, "PRICE_CHANGE_TOO_LARGE") at line 483 permanently blocks every new purchase attempt. The deadlock is self-reinforcing: purchasing requires updating cachedPrice, but purchasing is blocked until cachedPrice updates. event EmergencyPriceSet is declared at line 181 but no corresponding function exists anywhere in the contract — the recovery mechanism was designed but never implemented. An additional vulnerability exists on the first-ever purchase: when cachedPrice = 0, line 480's if (cachedPrice > 0) skips the entire protection check, leaving the first purchase completely unprotected against price manipulation within the MIN\PRICE ($0.03) to MAX\_PRICE ($1000) range.

Every buyPackageUnified() triggers _updateTeamBusinessUpline() at line 992, which iterates up to 50 ancestor levels. At each level, _calculateTeamMetrics() at line 977 iterates up to 500 direct referrals, reading users[ref].selfBusiness + users[ref].totalTeamVolume for each (2 cold SLOADs per entry at line 981). Worst case: 50 levels × 500 directs × 2 SLOADs = 50,000 storage reads ≈ 105M gas, well beyond Polygon's ~30M block gas limit. The unchangedCount >= 3 early exit at line 1006 does not fire along the buyer's legitimate upline path when the buyer's branch is within the first 500 directs of each ancestor — which is the case in the deliberate attack scenario. An attacker using the free registration exploit (HIGH-03) registers 500 sybils under each of 50 of the target's ancestor nodes for approximately 25,000 transactions × ~$0.001 = $25 total cost. Subsequently, the target's purchases require 50 × 500 × 2 = 50,000 SLOADs, permanently exceeding the block gas limit. Additionally, the 500-cap means directs at indices 501–999 are invisible to both totalVolume and strongest-leg calculations, producing incorrect rank metrics for highly active sponsors.

hourWindowStart is a public state variable and the window reset condition block.timestamp - hourWindowStart >= PRICE_STALE_THRESHOLD is fully deterministic from on-chain data. At the exact second a window expires, lines 491–492 reset hourWindowStart = block.timestamp and hourHighestPrice = freshPrice. An MEV bot monitoring the chain front-runs the reset with a purchase at a local price minimum, anchoring hourHighestPrice to the low value. Since effectivePrice = hourHighestPrice at line 495, all subsequent buyers in that window use this artificially anchored price, receiving more tokens per dollar than later buyers while the MEV bot maximizes its own token allocation. This pattern repeats every hour throughout the protocol's lifetime.

The _distributeDifferentialTokens function distributes token bonuses to a user's upline network whenever that user claims their package tokens. However, it executes these external transfers using a strict require(token.transfer(up, payout), "token transfer fail"); statement inside a for loop. If any single transfer in that loop fails, the error bubbles up and reverts the entire transaction. For example, if Alice attempts to claim her tokens, the contract automatically attempts to send a bonus to her upline sponsor, Bob. If Bob is a smart contract that rejects ERC20 tokens, or if the token owner decides to pause the GNZ token contract globally, the transfer to Bob will fail. Because of the require statement, this single failure will revert Alice's entire claimPackageTokens transaction, permanently locking Alice out of her earned tokens through no fault of her own. This effectively gives the token owner or a faulty upline a permanent veto over all user claims.