PAXE Protocol security record

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  - `renounceOwnership()`: Renounces ownership of the contract, leaving it without an owner. Privileged role: `onlyOwner`. - `transferOwnership(address newOwner)`: Transfers ownership of the contract to a new owner. Privileged role: `onlyOwner`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project. --- In the contract `Paxe` the role `_owner` has authority over the functions shown in the diagram below.  - `setSwapTokensAtAmount(uint256 amount)`: Sets the amount of tokens at which swapping will occur. Privileged role: `onlyOwner`. - `excludeFromFees(address account)`: Excludes an account from fees. Privileged role: `onlyOwner`. - `includeInFees(address account)`: Includes an account in fees. Privileged role: `onlyOwner`. - `excludeMultipleAccountsFromFees(address[] calldata accounts)`: Excludes multiple accounts from fees. Privileged role: `onlyOwner`. - `setTreasuryWallet(address payable wallet)`: Sets the treasury wallet address. Privileged role: `onlyOwner`. - `setAutomatedMarketMakerPair(address pair, bool value)`: Sets or unsets an automated market maker pair. Privileged role: `onlyOwner`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project. --- In the updated contract in `0xd2a3eec06719d5ac66248003b5488e02165dd2fa`, below privilege function is added: - `claimStuckTokens(address token)`: Allows the owner to transfer any tokens (other than Paxe token). If the token address is `0x0`, it transfers the contract's balance to the owner's address. Otherwise, it transfers the balance of the specified ERC20 token to the owner's address. Privileged role: `onlyOwner`.

In the function `setSwapTokensAtAmount()` the comment at the pointed locations states `"Amount must be between 0.001% - 0.1 of total supply"`. However, the actual code implementation goes as follows: ```sol=834 require( amount > totalSupply() / 10 ** 6 && amount <= totalSupply() / 10 ** 4, "Amount must be between 0.001% - 0.1 of total supply" ); ``` The upper bound in the `require` statement checks that `amount` is not greater than `totalSupply()/10 ** 4` which is equivalent to the `0.01%` of the total supply, while the comment states that the upper bound is the `0.1%`.

The contract has a `receive()` function or payable functions, making it able to receive native tokens. However, it does not have a function to withdraw the funds, which can lead to permanently locked tokens within the contract. ```solidity=831 receive() external payable {} ```

The owner is exempt from fees and transaction limits. Yet when ownership is reset through `renounceOwnership()` or `transferOwnership()`, the exemptions and allowance are not granted to the new owner nor are they revoked from the previous owner.

State variables that never change should be declared as `constant` to save gas. ```solidity=774 uint256 public treasuryBuyFee = 2; ``` - `treasuryBuyFee` should be declared `constant`. --- ```solidity=775 uint256 public treasurySellFee = 2; ``` - `treasurySellFee` should be declared `constant`.