DRX Token security record

As of 30 Oct 2026, DRX Token has 1 audit report on Trustblock, by CertiK, dated 19 Feb 2025. That report lists no open critical findings.

Critical findings
No open critical findings
In 1 report.
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits1

Newest first

AuditSecurity firmDateScopeCritical findingsReport
DRX TokenSecurity firm: CertiKDate: Scope: Repository at commit bf95c81No open critical findingsOpen · skynet.certik.com

Findings26

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical000
High501
Medium020
Low8010
HighAddresses Excluded From Fees Can Transfer When TrDRX Token · CertiK · 19 Feb 2025Fixed

The contract `DRX` contains a conditional check that is intended to restrict trading when `tradingActive` is set to false. However, the current implementation has a flaw where wallets that are marked as `_isExcludedFromFees` can still initiate trades regardless of the `tradingActive` status. This creates a scenario where certain privileged wallets can trade while the feature is ostensibly disabled for the rest of the users.<br>

Open the report
LowBroken `clearStuckTokens` LogicDRX Token · CertiK · 19 Feb 2025Fixed

The function `clearStuckTokens()` allows the `deployerWallet` to withdraw any tokens in the contract and keep a `toKeep` amount in it. If the input variable `toKeep` is equal to zero the function will fail because it will try to send to the `deployerWallet` the total balance of the contract two times. ```solidity=722 uint256 tokensToClear = totalBalance - tokensToKeep; if (tokensToClear > 0) { tokenContract.transfer(deployerWallet, tokensToClear); } if (toKeep == 0) { tokenContract.transfer(deployerWallet, totalBalance); } ```

Open the report
LowInconsistent CommentDRX Token · CertiK · 19 Feb 2025Fixed

The comment at the pointed location the comment `"WAGMI20: burn from the zero address"` is obsolete since it uses a different project name.

Open the report
LowIncreased Gas Costs from Using Logical AND in `reDRX Token · CertiK · 19 Feb 2025Fixed

The contract uses logical AND (`&&`) to connect multiple conditions within a single `require` statement, which is less gas-efficient than separate `require` statements for each condition. This practice results in higher gas consumption for transactions. For example, replacing one single `require` statement with two conditions connected by `&&` with two separate `require` statements can save 16 gas.

Open the report
LowPrivilege not Revoked or TransferredDRX Token · CertiK · 19 Feb 2025Fixed

The owner is exempt from fees and transaction limits. Yet when ownership is reset through `renounceOwnership()` or `transferOwnership()`, the exemptions and allowance are not granted to the new owner nor are they revoked from the previous owner.

Open the report
LowRedundant FunctionDRX Token · CertiK · 19 Feb 2025Fixed

The function `withdrawToken()` and the function `clearStuckTokens()` both allow the owner or the deployer to withdraw any token held by the contract at any time. However, the `owner` and the `deployerWallet` are the same address when the contract is deployed making those two functions redundant.

Open the report
LowRedundant Usage of SafeMathDRX Token · CertiK · 19 Feb 2025Fixed

Solidity version >=0.8.0 includes checked arithmetic operations and underflow/overflow by default, making SafeMath redundant.

Open the report
LowRequire without Error MessageDRX Token · CertiK · 19 Feb 2025Fixed

The `require()` function validates conditions and throws an exception if the condition fails. It is advisable to include a descriptive error message, which will be returned to the caller, providing details about the failure.

Open the report
LowState Variable Should Be Declared ConstantDRX Token · CertiK · 19 Feb 2025Fixed

State variables that never change should be declared as `constant` to save gas. ```solidity=529 uint256 public initialTotalSupply = 50000000000 * 1e18; ``` - `initialTotalSupply` should be declared `constant`. ```solidity=533 uint256 public swapTokensAtAmountPercent = 1; ``` - `swapTokensAtAmountPercent` should be declared `constant`. ```solidity=522 address private marketingWallet = payable(address(0xA733654C456066E1c0933E8C2d18945531daac44)); ``` - `marketingWallet` should be declared `constant`. ```solidity=532 uint256 public maxWalletPercent = 2; ``` - `maxWalletPercent` should be declared `constant`. ```solidity=531 uint256 public maxTransactionAmountPercent = 2; ``` - `maxTransactionAmountPercent` should be declared `constant`.

Open the report
LowToo many digitsDRX Token · CertiK · 19 Feb 2025Fixed

Literals with many digits are difficult to read and review. ```solidity=529 uint256 public initialTotalSupply = 50000000000 * 1e18; ```

Open the report
Show 1 more
LowUnderscore Prefix For Non-External VariablesDRX Token · CertiK · 19 Feb 2025Fixed

The current contract doesn't follow the naming convention specified by [Solidity DOC](https://docs.soliditylang.org/en/v0.8.20/style-guide.html#underscore-prefix-for-non-external-functions-and-variables): The state variable `variable` is used as `private` or `internal` and is not exposed publicly. It should have `an underscore prefix` like `_varaible`. Leading underscores allow you to immediately recognize the intent of such functions, but more importantly, if you change a function from non-external to external (including public) and rename it accordingly, this forces you to review every call site while renaming. This can be an important manual check against unintended external functions and a common source of security vulnerabilities (avoid find-replace-all tooling for this change).

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="drx-token"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us