BNB Chain - BGBP (refreshed)

In the contract `BGBPToken` the role `_owner` has authority over the functions shown in the diagrams below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and modify the owner, manipulate the blacklist, deprecate the token for a new one, etc.
![](https://accelerator-tasks-prod.acc.corp.certik.com/d67a2dedb0be470cb136e95fe67ed223/diagrams/centralization_BGBPToken-BGBPToken-_owner.svg)

![](https://accelerator-tasks-prod.acc.corp.certik.com/d67a2dedb0be470cb136e95fe67ed223/diagrams/centralization_BGBPToken-BlackListableToken-_owner.svg)

![](https://accelerator-tasks-prod.acc.corp.certik.com/d67a2dedb0be470cb136e95fe67ed223/diagrams/centralization_BGBPToken-Ownable-_owner.svg)

The change of the contract's owner overrides the previously set owner with the new one without guaranteeing the new owner is able to actuate transactions on-chain.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

A local variable is shadowing another component defined elsewhere.

```solidity=769
 function allowance(address _owner, address _spender) public view returns (uint256 remaining) {
```
- Local variable `_owner` in `BGBPToken.allowance()` shadows the variable `_owner` in `Ownable`.

Solidity frequently releases new compiler versions. Using an old version prevents access to new Solidity security features. We also recommend avoiding complex `pragma` statements.

The pragma statement in use allows old versions:

```solidity=1
pragma solidity 0.5.8;
```

There are some typos in the comments.

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.