XODEX

In the contract `XODEX` the role `_owner` has authority over the functions shown in the diagram below. If the `_owner` account is compromised then consider the following worst case scenario: 1. The `XODEX` contract can be configured to revert all transfers. 2. The new `owner` can blacklist all holders. 3. The new `owner` can re-enable transfers and drain the LP pool of all BNB.  Further, below are the state altering functions that are unique to this contract and the Owner() caller. - `blacklist_Wallets(address[] calldata addresses)`: Blacklists an array of wallet addresses, restricting them from performing transactions - `blacklist_Toggle(bool true_or_false)`: Toggles the blacklist feature on or off - `Update__Dev_Wallet(address payable wallet)`: Updates the developer wallet address and excludes it from fees - `excludeFromFee(address account)`: Excludes an account from fees - `includeInFee(address account)`: Includes an account in fees - `process_Tokens(uint256 percent_Of_Tokens_To_Process)`: Processes a specified percentage of tokens on the contract - `recover_Tokens(address Token_Address, address send_to_wallet, uint256 number_of_tokens)`: Recovers tokens (excluding native tokens) from the contract and sends them to a specified wallet - `set_New_Router_and_Make_Pair(address newRouter)`: Sets a new router and creates a new pair for token swapping - `set_New_Router_Address(address newRouter)`: Sets a new router address for token swapping - `set_New_Pair_Address(address newPair)`: Sets a new pair address for token swapping - `set_Swap_And_Liquify_Enabled(bool true_or_false)`: Toggles the swap and liquify feature on or off - `set_Number_Of_Transactions_Before_Liquify_Trigger(uint8 number_of_transactions)`: Sets the number of transactions required before triggering the liquify feature - `set_TransferFees(bool true_or_false)`: Toggles the transfer fee feature on or off - `set_Max_TX_Percent(uint256 maxTxPercent_x100)`: Sets the maximum transfer limit as a percentage of the total supply - `set_Max_Wal_Percent(uint256 maxWallPercent_x100)`: Sets the maximum wallet limit as a percentage of the total supply - `unBlacklist_Wallets(address[] calldata addresses)`: Unblacklists an array of wallet addresses, allowing them to perform transactions again - `_set_Fees(uint256 Buy_Fee, uint256 Sell_Fee)`: Sets the buy and sell fees - `_set_Transfer_Fee(uint256 Transfer_Fee)`: Sets the transfer fee

All XODEX tokens are sent to the `owner` when deploying the contract. Therefore the `owner` completely determines the token distribution.

The `transfer` and `transferFrom` functions rely on the `_transfer` function. This function includes the following logical statement: ```solidity if (...) { uint256 heldTokens = balanceOf(to); require( // FINDING on REVERT (heldTokens + amount) <= _maxToken, "You are trying to buy too many tokens. You have reached the limit for one wallet." ); } ``` If the `to` address has a balance of tokens smaller than the `_maxToken` limit, it is possible to deny a transfer if the `owner()` updates the `_maxToken` limit to be less than the balance of the `to` address.