CertiK reviewed XODEX on 19 May 2023: 18 findings, 0 critical; 8 marked fixed, 3 acknowledged, 7 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 1 |
| Medium | 0 | 1 | 2 |
| Low | 7 | 0 | 5 |
The `recover_Tokens` function allows the `owner` to call the transfer function on any ERC20 token type.
The `blacklist_Wallets()` and `unBlacklist_Wallets()` functions allow the owner to add or remove addresses from the blacklist. However, if the transaction is submitted with an insufficient amount of gas, not all addresses will be properly updated.
The `Update__Dev_Wallet` function allows the owner to update the `Dev_wallet`. However it does not enforce that the former `Dev_wallet` is included a fee on transfer.
The XODEX contract lacks comments, natspec, or documentation explaining the specific use case of each function. There is no base line for testing or deployment. This can cause an issue as there are numerous configurations that the `owner` can call that can cause this contract to no longer have full functionality. Further, the functions themselves have been permutated in a random order.
When transferring tokens a fee is charged. The max holding of the receiver should be equivalent to the sum of the held tokens plus the amount received from the transfer. The fees should not be included in the max holding. However, within the internal `_transfer` function the following statement occurs: ```solidity=731 require( (heldTokens + amount) <= _maxToken, "You are trying to buy too many tokens. You have reached the limit for one wallet." ); ```
The XODEX contract is defined using using the solidity compiler version of at least 0.8.7. The compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. Therefore the `SafeMath` library is used unnecessarily. *Note: The `sub()` function of SafeMath is used to return error strings.*
The function `sendToWallet` uses `transfer()` to send BNB. It is not recommended to use solidity's `transfer()` function for transferring BNB. Note this is not an issue if `Dev_Wallet` is an EOA. However, some contracts that can receive now may stop working in the future due to the gas limitation.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us