XRADERS-Audit

CertiK25 Mar 20241 address on BNB Chain

Audit

CertiK reviewed XRADERS (XRADERS-Audit) on 25 Mar 2024: 5 findings, 0 critical; 4 marked fixed, 1 open.

No open critical findings

Open the report Open XRADERS’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	1	2
Medium	0	0
Low	0	2

HighCentralization related risksFixed

In the contract `OwnableUpgradeable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer/renounce ownership. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-e690-55031ad0-bcbf-6995be6925a5/diagrams/centralization_OwnableUpgradeable-OwnableUpgradeable-_owner.svg) ----- In the contract `XrToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint tokens, pause/unpause the contract. ![](https://accelerator-tasks-prod.acc.corp.certik.com/11ee-e690-55031ad0-bcbf-6995be6925a5/diagrams/centralization_XrToken-XrToken-_owner.svg)

HighCentralized Control of Contract UpgradeFixed

In the contract `XrToken`, the role `admin` has the authority to update the implementation contract behind the proxy contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.

LowInherited Contracts Not Initialized In InitializeFixed

Generally, the initializer function of a contract should always call all the initializer functions of the contracts that it extends. However, Contract `OwnableUpgradeable` does not initialize its base contract `ContextUpgradeable`. Contract `ERC20PermitUpgradeable` does not initialize its base contract `NoncesUpgradeable`. Contract `ERC20BurnableUpgradeable` does not initialize its base contract `ContextUpgradeable`. Contract `PausableUpgradeable` does not initialize its base contract `ContextUpgradeable`. Contract `ERC20Upgradeable` does not initialize its base contract `ContextUpgradeable`.

LowUnused dependencyFixed

The `ERC20FlashMintUpgradeable` is not used in the contract.