Ice Coin security record

5% of the ICE tokens are sent to the contract owner. 80% of the ICE tokens are used for pool liquidity, and LP tokens are sent to the contract owner after `enableTrading()`. This is a centralization risk because the owner can distribute tokens or remove liquidity without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

The `disableClaim()` function transfers the entire balance of tokens held by the `address(NFT)` to a burn address (`address(0xdead)`): ```solidity=1158 _transfer(address(NFT), address(0xdead), balanceOf(address(NFT))); ``` This action is intended to prevent further token claims by NFT holders. However, the implemented `_transfer()` function used for this purpose does not reduce the total supply of the ICE tokens, as it merely transfers the tokens to the burn address without decrementing the total supply counter. This can lead to a discrepancy between the actual circulating supply and the reported total supply.

The transaction may be charged fees, so the max holding of the receiver should be the sum of the tokens held and the amount received from the transfer. The fees should not be included in the max holding. ```solidity=1250 require( amount + balanceOf(to) <= maxWallet, "Max wallet exceeded" ); ``` - Max holding is checked. ```solidity=1295 amount -= fees; ``` - Receiving amount is adjusted. ```solidity=487 _balances[recipient] = _balances[recipient].add(amount); ``` - Balance is increased by the adjusted amount.

The allowance is approved to the router based on the token swapping amount in the swapTokensForEth function. Therefore, approving the maximum allowance to the router is redundant and unnecessary.

The contract constructor excludes the DEX router from the maximum wallet holding restriction: ```solidity=1103 excludeFromMaxWallet(address(_uniswapV2Router), true); ``` This exclusion is unnecessary as the DEX router is responsible for transferring tokens from traders directly to the DEX pair, and does not hold tokens itself. The exclusion should be applied to the DEX pair instead, which is the entity that actually holds the tokens after trades.