Galactix Zone v2

One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=56 function initialize( ``` `initialize` has memory location parameters: `_pauseExemptions`, `_taxExemptions`.

In the `__GalactixToken__init_unchained()` function, state variables `commonTaxRate` and `ownerTaxRate` are set without value validation, there will be a risk that the value of these two state variables can be greater than `ONE_HUNDRED_PERCENT`. ```solidity=105 function __GalactixToken__init_unchained( address _admin, uint256 _totalSupply, uint256 _commonTaxRate, uint256 _ownerTaxRate, address _commonTaxRecipient, address _ownerTaxRecipient, address[] memory _pauseExemptions, address[] memory _taxExemptions ) internal onlyInitializing { commonTaxRate = _commonTaxRate; ownerTaxRate = _ownerTaxRate; ``` And in functions `setCommonTaxRate()` and `setOwnerTaxRecipient()`, both of them have a `require` statement to protect the value of tax rate becoming greater than `ONE_HUNDRED_PERCENT(10,000)`, but tax rates are still able to be set with a very big value, e.g. 9999(tax rate 99%). ```solidity=379 function setCommonTaxRate(uint256 _newTaxRate) external onlyOwner { require(_newTaxRate <= ONE_HUNDRED_PERCENT, 'GXZ: invalid tax rate!'); commonTaxRate = _newTaxRate; } function setOwnerTaxRate(uint256 _newTaxRate) external onlyOwner { require(_newTaxRate <= ONE_HUNDRED_PERCENT, 'GXZ: invalid tax rate!'); ownerTaxRate = _newTaxRate; } ```

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

Signed messages are not properly verified with the current **chain ID**, thus allowing attackers to perform replay attacks across chains. Hardcoded or cached chain ID values are also vulnerable since a hard fork may occur and change the chain ID in the future. ```solidity=15 bytes32 messageHash = getMessageHash(_nonce, _salePhase, _signer, _candidate, _BUSDAmount); bytes32 ethSignedMessageHash = getEthSignedMessageHash(messageHash); address signerAddress = getSignerAddress(ethSignedMessageHash, _signature); return signerAddress == _signer; ``` - The library function `verifySignature()`, which eventually calls `ecrecover`. The **chain ID** is not used for creating a signed message hash. ```solidity=17 address signerAddress = getSignerAddress(ethSignedMessageHash, _signature); ``` - Calling `getSignerAddress`, which eventually calls `ecrecover`. ```solidity=36 return ECDSA.recover(_messageHash, _signature); ``` - Calling `ECDSA.recover()` with a hash that does not properly include the chain ID.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=37 IAntisnipe public antisnipe; ``` - The contract `GalactixZoneToken` interacts with third party contract with `IAntisnipe` interface via `antisnipe`.

The smart contract does not check or store the return value of an external call in a local or state variable, which may introduce vulnerabilities due to the unhandled outcome. ```solidity=121 isPauseExempt.add(_admin); ``` --- ```solidity=122 isTaxExempt.add(_admin); ``` --- ```solidity=125 isPauseExempt.add(_pauseExemptions[i]); ``` --- ```solidity=129 isTaxExempt.add(_taxExemptions[i]); ```