DRX Token

CertiKRepository at commit bf95c81

CertiK reviewed DRX Token on 19 Feb 2025: 26 findings, 0 critical; 11 marked fixed, 2 acknowledged, 13 open.

No open critical findings
Open the reportOpen DRX Token’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings26

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High501
Medium020
Low8010
HighAddresses Excluded From Fees Can Transfer When TrFixed

The contract `DRX` contains a conditional check that is intended to restrict trading when `tradingActive` is set to false. However, the current implementation has a flaw where wallets that are marked as `_isExcludedFromFees` can still initiate trades regardless of the `tradingActive` status. This creates a scenario where certain privileged wallets can trade while the feature is ostensibly disabled for the rest of the users.<br>

LowBroken `clearStuckTokens` LogicFixed

The function `clearStuckTokens()` allows the `deployerWallet` to withdraw any tokens in the contract and keep a `toKeep` amount in it. If the input variable `toKeep` is equal to zero the function will fail because it will try to send to the `deployerWallet` the total balance of the contract two times. ```solidity=722 uint256 tokensToClear = totalBalance - tokensToKeep; if (tokensToClear > 0) { tokenContract.transfer(deployerWallet, tokensToClear); } if (toKeep == 0) { tokenContract.transfer(deployerWallet, totalBalance); } ```

LowInconsistent CommentFixed

The comment at the pointed location the comment `"WAGMI20: burn from the zero address"` is obsolete since it uses a different project name.

LowIncreased Gas Costs from Using Logical AND in `reFixed

The contract uses logical AND (`&&`) to connect multiple conditions within a single `require` statement, which is less gas-efficient than separate `require` statements for each condition. This practice results in higher gas consumption for transactions. For example, replacing one single `require` statement with two conditions connected by `&&` with two separate `require` statements can save 16 gas.

LowPrivilege not Revoked or TransferredFixed

The owner is exempt from fees and transaction limits. Yet when ownership is reset through `renounceOwnership()` or `transferOwnership()`, the exemptions and allowance are not granted to the new owner nor are they revoked from the previous owner.

LowRedundant FunctionFixed

The function `withdrawToken()` and the function `clearStuckTokens()` both allow the owner or the deployer to withdraw any token held by the contract at any time. However, the `owner` and the `deployerWallet` are the same address when the contract is deployed making those two functions redundant.

LowRedundant Usage of SafeMathFixed

Solidity version >=0.8.0 includes checked arithmetic operations and underflow/overflow by default, making SafeMath redundant.

LowRequire without Error MessageFixed

The `require()` function validates conditions and throws an exception if the condition fails. It is advisable to include a descriptive error message, which will be returned to the caller, providing details about the failure.

LowState Variable Should Be Declared ConstantFixed

State variables that never change should be declared as `constant` to save gas. ```solidity=529 uint256 public initialTotalSupply = 50000000000 * 1e18; ``` - `initialTotalSupply` should be declared `constant`. ```solidity=533 uint256 public swapTokensAtAmountPercent = 1; ``` - `swapTokensAtAmountPercent` should be declared `constant`. ```solidity=522 address private marketingWallet = payable(address(0xA733654C456066E1c0933E8C2d18945531daac44)); ``` - `marketingWallet` should be declared `constant`. ```solidity=532 uint256 public maxWalletPercent = 2; ``` - `maxWalletPercent` should be declared `constant`. ```solidity=531 uint256 public maxTransactionAmountPercent = 2; ``` - `maxTransactionAmountPercent` should be declared `constant`.

LowToo many digitsFixed

Literals with many digits are difficult to read and review. ```solidity=529 uint256 public initialTotalSupply = 50000000000 * 1e18; ```

Show 1 more
LowUnderscore Prefix For Non-External VariablesFixed

The current contract doesn't follow the naming convention specified by [Solidity DOC](https://docs.soliditylang.org/en/v0.8.20/style-guide.html#underscore-prefix-for-non-external-functions-and-variables): The state variable `variable` is used as `private` or `internal` and is not exposed publicly. It should have `an underscore prefix` like `_varaible`. Leading underscores allow you to immediately recognize the intent of such functions, but more importantly, if you change a function from non-external to external (including public) and rename it accordingly, this forces you to review every call site while renaming. This can be an important manual check against unintended external functions and a common source of security vulnerabilities (avoid find-replace-all tooling for this change).

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • https://github.com/ipds13/drxtoken/smart_contract/DRX_TOKEN.sol at commit bf95c815c6d43a5118ca6e7a9d9ca36e97c97326

Part of DRX Token’s security record

DRX Token
Audits1 audit by 1 firmLast audit Feb 2025, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open DRX Token’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us