Galactix Zone security record

In the contract `GalactixZoneToken` the role `_owner` has authority over the functions shown in the diagram below. - `function setPause()`: Modifies the pause status of the contract. When the contract is paused, only addresses that are not the `owner()` and are added to the `isPauseExempt` mapping can transfer tokens to addresses that are not the `owner()`. - `function updatePauseExempt()`: Adds or removes an address from the `isPauseExempt` mapping. Addresses in the `isPauseExempt` mapping are allowed to execute token transfers when the contract is paused. - `function updateTaxExempt()`: Adds or removes an address from the `isTaxExempt` mapping. Only addresses in the `isTaxExempt` mapping can execute token transfers without paying taxes (common tax and owner tax) when transacting with **POOL** addresses. - `function updateLiquidityPoolAddresses()`: Adds or removes an address from the `liquidityPoolAddresses` mapping. Addresses not in the `isTaxExempt` mapping need to pay taxes if they have token transfers with addresses in the `liquidityPoolAddresses` mapping. - `function batchAirdrop()`: Allows the `owner()` role to send any amount of `GXZ` tokens in bulk to multiple addresses. - `function setAntisnipeDisable()`: Disables the calling of third-party dependencies via the `IAntisnipe` interface. - `function setAntisnipeAddress()`: Modifies the implementation of the third-party contract called via the `IAntisnipe` interface. - `function setCommonTaxRate()`: Sets the tax rate for **COMMON TAX**. - `function setOwnerTaxRate()`: Sets the tax rate for **OWNER TAX**. - `function setCommonTaxRecipient()`: Sets the recipient address for **COMMON TAX**. - `function setOwnerTaxRecipient()`: Sets the recipient address for **OWNER TAX**. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

`GalactixZoneToken` is an upgradeable contract, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

All of the `GalactixCoin` tokens are sent to the one externally-owned account (EOA) address. ```solidity=132 _mint(_admin, _totalSupply); ``` And, there is a privileged function `batchAirdrop()` which allows the role `owner` to transfer any amount of `GXZ` tokens to any address in the batch. ```solidity=328 function batchAirdrop( address[] memory _airdropAddresses, uint256[] memory _airdropAmounts ) external onlyOwner { if (_airdropAddresses.length != _airdropAmounts.length) { revert('Addresses and amounts must be equal length'); } if (!locked) { _batchAirdrop(_airdropAddresses, _airdropAmounts); } } function _batchAirdrop(address[] memory _addresses, uint256[] memory _amounts) private lockFunction { uint256 senderBal = _balances[_msgSender()]; uint256 totalSent = 0; uint256 arraySize = _addresses.length; for (uint256 i = 0; i < arraySize; ++i) { totalSent += _amounts[i]; _balances[_addresses[i]] += _amounts[i]; emit Transfer(_msgSender(), _addresses[i], _amounts[i]); } if (senderBal < totalSent) revert('Insufficient balance from airdrop instigator'); uint256 newBalance = senderBal - totalSent; _balances[_msgSender()] = newBalance; emit AirDrop(_msgSender(), totalSent, arraySize); } ``` This is a centralization risk because the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to the owner's account allows a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

In the contract `GalactixZoneToken`, the role `owner()` has the authority to update the status of the `_requireNotPaused` function and further pause/resume the functionality of the `_transfer` function. Any compromise to the private key of the `owner` may allow hackers to take advantage of this authority and allow/prevent external user access to the sensitive functionalities controlled by the `_requireNotPaused` function.