UnityMeta Token Audit

Tokens are sent to owner when deploying the contract. This could be a centralization risk as the owner can distribute tokens without obtaining the consensus of the community.

The `_transfer` function checks if the `_maxBurning` limit is reached before burning tokens. However, the tokens that will be burned in this transaction are not taken into account in the calculation. ```solidity if( _totalBurning < _maxBurning) { uint256 tokensToBurn = _burnToken(amount); _totalBurning = _totalBurning.add(tokensToBurn); ``` The correct code should be: ```solidity uint256 tokensToBurn = _burnToken(amount); if ((_totalBurning + tokensToBurn) <= _maxBurning) { _totalBurning = _totalBurning.add(tokensToBurn); ```

The function `_transfer()` from the contract `UnityMetaToken`, checks if the sender and recipient are allowed to transfer tokens using the variable: - `mapping(address => bool) public allowedTransfer` However, when the variable is set to true, the transactions are not allowed: ```solidity require(!allowedTransfer[sender] && !allowedTransfer[recipient], "Transfer not allowed"); ```

The transaction may be charged fees, so the max holding of the receiver should be the sum of the held tokens and the amount received from the transfer. The fees should not be included in the max holding. - Max holding is checked: ```solidity=277 require(_balances[recipient] + amount <= maxWalletLimit,"Receiver are exceeding maxWalletLimit"); ``` - Receiving amount is adjusted. ```solidity=286 transferAmount = amount.sub(tokensToBurn); ``` - Balance is increased by the adjusted amount. ```solidity=288 _balances[recipient] = _balances[recipient].add(transferAmount); ```

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

State variables that never change should be declared as `constant` to save gas. ```solidity=131 uint256 public basePercent = 1; ``` - `basePercent` should be declared `constant`.

Literals with many digits are difficult to read and review.

The return value of the transfer()/transferFrom() call is not checked. ```solidity=324 IBEP20(_tokenAddr).transfer(_to, _amount); ```

The contracts cited have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

The `SafeMath` library is used unnecessarily. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=36 library SafeMath { ``` - An implementation of `SafeMath` library is found. --- ```solidity=126 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `UnityMetaToken` contract. ```solidity=235 uint256 burnAmount = amount.mul(basePercent).div(1000); ``` - `SafeMath.mul` is called in `_burnToken` function of `UnityMetaToken` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 14) are shown above.*