XOX Labs security record

The function `burn` can be called by anyone to burn or mint any amount of tokens from any other, which shouldn't be allowed.

The `_tokenTransfer()` function, when called with the `takeFee` parameter set to `true`, deducts a fee from the transferred amount and sends it directly to the contract owner's balance. This could potentially lead to a concentration of tokens in the owner's balance, causing the inequitable distribution of tokens and potentially enabling manipulation of token value.

The function `_changeTaxFee()` is declared as internal, which means it can only be called from within the contract where it is defined or contracts derived from it. However, this function is not utilized in any other public or external functions within `XOXTokenBase` contract or potentially inheriting contracts, making it inaccessible and essentially useless in the current implementation.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=41 _minter = minter_; ``` - `minter_` is not zero-checked before being used. --- ```solidity=79 _operator = operator_; ``` - `operator_` is not zero-checked before being used.

The `SafeMath` library is used unnecessarily in the `XOXTokenBase` contract. With Solidity compiler versions 0.8.0 or newer, arithmetic operations will automatically revert in case of integer overflow or underflow. ```solidity=39 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `XOXTokenBase` contract. --- ```solidity=39 using SafeMath for uint256; ``` - `SafeMath` library is used for `uint256` type in `XOXTokenBase` contract. ```solidity=323 uint256 fee = amount.mul(_taxFee).div(_baseFee); ``` - `SafeMath.mul` is called in `_tokenTransfer` function of `XOXTokenBase` contract. *Note: Only a sample of 2 `SafeMath` library usage in this contract (out of 4) are shown above.*

```solidity uint8 private _decimals; address private _operator; uint256 private _startTrading; ``` The above variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.