Whale Token - audit

All of the `Whale` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project. ### Onchain Analysis(01/22/2025) The contract has been deployed at address [0x96e8d3a52Dd950AaCC8d1749932e1C14BC76e371](https://bscscan.com/address/0x96e8d3a52dd950aacc8d1749932e1c14bc76e371) by the deployer [0xE660ac26DDe19D6A3Ea89f53ce36310b7a8C8556](https://bscscan.com/address/0xE660ac26DDe19D6A3Ea89f53ce36310b7a8C8556) in the transaction [0xb88d905c319aa31461407cf25d42ccc8a55a095b3916b1e7750d266a5a382540](https://bscscan.com/tx/0xb88d905c319aa31461407cf25d42ccc8a55a095b3916b1e7750d266a5a382540). During the deployment, all 10,000,000,000 `Whale` tokens were sent to the deployer. Subsequently, these tokens were transferred from the deployer to [0xC0826c376c59DEa41dE19BB5b077Bb28c1213923](https://bscscan.com/address/0xC0826c376c59DEa41dE19BB5b077Bb28c1213923), which is responsible for distributing them to other accounts for various purposes. The related token transfer information can be found [here](https://bscscan.com/token/0x96e8d3a52dd950aacc8d1749932e1c14bc76e371?a=0xc0826c376c59dea41de19bb5b077bb28c1213923). It is noted that [0xC0826c376c59DEa41dE19BB5b077Bb28c1213923](https://bscscan.com/address/0xC0826c376c59DEa41dE19BB5b077Bb28c1213923) transferred 1,500,000,000 tokens to [0x44F475Af893dc31475c148E76718B1F17BfbEBd2](https://bscscan.com/address/0x44F475Af893dc31475c148E76718B1F17BfbEBd2). The latter then added these tokens to the pool [0x4f3066dF23cB802f03C02340AC2ABc25ce882432](https://bscscan.com/address/0x4f3066df23cb802f03c02340ac2abc25ce882432) and received 424,264.06871192 LP tokens in the transaction [0xabb1ee98091af3ece13ce2b90f6e016fc8a36e17442700ee2c46c49a8d9a8a20](https://bscscan.com/tx/0xabb1ee98091af3ece13ce2b90f6e016fc8a36e17442700ee2c46c49a8d9a8a20). Later, [0x44F475Af893dc31475c148E76718B1F17BfbEBd2](https://bscscan.com/address/0x44F475Af893dc31475c148E76718B1F17BfbEBd2) locked 400,000 tokens in the transaction [0x49fb96ea6836efd73489710e32c1d91d4346d01650b870fa4e075ad113706ff2](https://bscscan.com/tx/0x49fb96ea6836efd73489710e32c1d91d4346d01650b870fa4e075ad113706ff2). For a list of LP token holders, refer to the following link: [LP holders](https://bscscan.com/token/0x4f3066df23cb802f03c02340ac2abc25ce882432#balances).

The deployed smart contract at address [0x96e8d3a52dd950aacc8d1749932e1c14bc76e371](https://bscscan.com/address/0x96e8d3a52dd950aacc8d1749932e1c14bc76e371) lacks a mechanism for privileged roles to recover tokens that may be accidentally transferred to the contract. This oversight results in the inability to retrieve valuable tokens that are stuck within the contract. Without such a feature, any tokens sent to the contract address by mistake cannot be recovered.

The contract has a `receive()` function or payable functions, making it able to receive native tokens. However, it does not have a function to withdraw the funds, which can lead to permanently locked tokens within the contract. ```solidity=288 receive() external payable {} ```