Maxxer

Smart Contract Audit Report

Audit Summary

Maxxer is developing a new token with additional vesting properties.

For this audit, we reviewed the project team's Maxxer contract at 0x9af096c0c46e413fe46889255017e6f1f8bc18e2 and MaxxerVesting contract at 0x7df92d4d5a9c19022fa6e41acdb12fe3d2b168e0 on the Ethereum Mainnet as well as the Authenticity and Migrations contracts provided to us by the project team.

Audit Findings

Please ensure trust in the team prior to investing as they have substantial control in the ecosystem.
Date: March 3rd, 2022.
Updated: March 17th, 2022 to address changes made by the team.
Updated: March 24th, 2022 to address further changes made by the team.
Updated: May 5th, 2022 to reflect deployment to the Ethereum Mainnet.

Finding #1 - Maxxer - Low (Resolved)

Description: The selfdestruct() function's gas refunds have been reduced which greatly diminishes any potential benefit self-destructing poses. Additionally, the selfdestruct opcode is intended to be deprecated in the near future.
Risk/Impact: The team can destroy the contract and any associated state at any time.
Recommendation: The team should remove the destroyContract() function to alleviate these concerns.
Resolution: The team has removed the selfdestruct() function.

---

Finding #2 - Maxxer - Informational (Resolved)

Description: Several functions are declared public, but are never called internally.

Maxxer.setMintEnable, Maxxer.withdraw, MaxxerVesting.withdrawFoundersToken, MaxxerVesting.withdrawAdvisorsToken, MaxxerVesting.withdrawTeamToken, Authenticity.addContract, Authenticity.getAddresses, Migrations.setCompleted

Recommendation: We recommend declaring these functions external for additional gas savings on each call.
Resolution: The functions above have been removed or declared external.

---

Finding #3 - MaxxerVesting - Informational (Resolved)

Description: Several state variables can never be modified, but are not declared constant.

ADVISORS_TOTAL_TOKEN, FOUNDERS_TOTAL_TOKEN, TEAM_TOTAL_TOKEN

Recommendation: We recommend declaring these state variables constant for additional gas savings on each call.
Resolution: The team has implemented the above recommendation.

Contracts Overview

MaxxerVesting Contract:

• This contract allows the owner to claim vested Maxxer tokens for the founders, advisors, and team group.
• The vesting start time is set on deployment and releases each group's individual amounts in equal portions over 36 months. In the contract's current state, a month is set to 30 days.
• The founders group's total vested token amount is 270 million, the advisors group's total vested token amount is 36 million, and the team group is allocated 54 million in total vested tokens.
• The owner must claim any vested tokens for each individual group for the tokens to be sent to each address. The team should exercise caution when setting the addresses on deployment as they cannot be changed.


• The owner can transfer ownership at any time.
• The owner can claim each groups unlocked tokens for them at any time.
• The contract utilizes the SafeMath library to prevent overflow/underflow attacks.

Maxxer Contract:

• The total supply is set by the team upon deployment and is held by the owner.
• There is no burn function, but the tokens can be sent to the 0x..dead address to reduce the circulating supply at any time.
• A fee rate is charged on all transfers and is sent to the owner; the maximum fee rate is 0.9% with a maximum fee amount of 100 tokens and a minimum fee amount of 5 tokens.
• Users that are blacklisted cannot transfer Maxxer tokens and can have their Maxxer tokens cleared.
• The contract can be upgraded to a new contract that inherits all non-blacklisted users' balances. Users will be unable to transfer tokens using the former contract.
• The contract's functionality is dependent on successful authentication by an Authenticity contract.
• The Authenticity contract is intended to be used as the Authenticity address; the team can add any contract address to the Authenticity contract's whitelist.


• The owner can withdraw any tokens from the contract at any time.
• The owner can increase the total supply of Maxxer tokens by any amount up to 10 million at any time.
• The owner can decrease the total supply of Maxxer tokens by any amount equal to or less than the total supply and owner's balance amount.
• The owner can update the fee rate, maximum fee range, and minimum fee amount at any time.
• The owner may blacklist any user and clear their token balance at any time.
• The owner may upgrade or destroy the contract at any time.
• The contract utilizes the SafeMath library to prevent overflow/underflow attacks.
• In the event that the address receiving Maxxer tokens is a contract, the contract must have implemented the onERC223Received() function in order to successfully receive the tokens.

Audit Results

Maxxer Contract

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
 +  ERC223ReceivingContract 
    - [Ext] tokenFallback #

 +  ERC223Interface 
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] transfer #

 +  UpgradedStandardToken 
    - [Ext] transferByHolder #

 +  Authenticity 
    - [Pub] getAddress

 + [Lib] safeMath 
    - [Int] add
    - [Int] sub
    - [Int] mul
    - [Int] div

 +  Ownable 
    - [Int]  #

 +  BlackList (Ownable)
    - [Ext] getBlackListStatus
    - [Pub] addBlackList #
       - modifiers: onlyOwner
    - [Pub] removeBlackList #
       - modifiers: onlyOwner

 +  BasicERC223 (BlackList, ERC223Interface)
    - [Int] isContract
    - [Int] calculateFee
    - [Int] transferToContract #
    - [Int] transferToAddress #
    - [Int] holderIsExist #
    - [Pub] holder
       - modifiers: onlyOwner

 +  Maxxer (BasicERC223)
    - [Pub]  #
    - [Pub] totalSupply
       - modifiers: IsAuthenticate
    - [Pub] balanceOf
       - modifiers: IsAuthenticate
    - [Pub] transfer #
       - modifiers: IsAuthenticate
    - [Pub] transfer #
       - modifiers: IsAuthenticate
    - [Pub] authenticate #
       - modifiers: onlyOwner
    - [Pub] withdrawForeignTokens #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] increaseSupply #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] decreaseSupply #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] setParams #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] destroyBlackFunds #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] deprecate #
       - modifiers: onlyOwner,IsAuthenticate
    - [Pub] destroyContract #
       - modifiers: onlyOwner,IsAuthenticate

MaxxerVesting Contract

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
 +  ERC223Interface 
    - [Pub] balanceOf
    - [Pub] transfer #
    - [Pub] transfer #

 + [Int] ERC223ReceivingContract 
    - [Ext] tokenFallback #

 + [Lib] SafeMath 
    - [Int] mul
    - [Int] div
    - [Int] sub
    - [Int] add

 +  Context 
    - [Int] _msgSender
    - [Int] _msgData

 +  Ownable (Context)
    - [Pub]  #
    - [Pub] owner
    - [Pub] renounceOwnership #
       - modifiers: onlyOwner
    - [Pub] transferOwnership #
       - modifiers: onlyOwner
    - [Prv] _setOwner #

 +  MaxxerVesting (ERC223ReceivingContract, Ownable)
    - [Pub]  #
    - [Int] initVestingStages #
    - [Ext] tokenFallback #
    - [Pub] withdrawFoundersToken #
       - modifiers: onlyOwner
    - [Pub] withdrawAdvisorsToken #
       - modifiers: onlyOwner
    - [Pub] withdrawTeamToken #
       - modifiers: onlyOwner
    - [Pub] getAvailableTokensOfFounders
    - [Pub] getAvailableTokensOfAdvisors
    - [Pub] getAvailableTokensOfTeam
    - [Prv] getTokensUnlocked
    - [Prv] getTokensAmountAllowedToWithdraw
    - [Prv] sendTokens #

Authenticity Contract

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
  +  Ownable 
    - [Int]  #

 +  Authenticity (Ownable)
    - [Pub]  #
    - [Pub] getAddress
       - modifiers: withContract
    - [Pub] addContract #
       - modifiers: onlyOwner,withContract
    - [Pub] getAddresses

Migrations Contract

 ($) = payable function
 # = non-constant function
 
 Int = Internal
 Ext = External
 Pub = Public
 
   +  Migrations 
    - [Pub] setCompleted #
       - modifiers: restricted

About SourceHat

SourceHat has quickly grown to have one of the most experienced and well-equipped smart contract auditing teams in the industry. Our team has conducted 1800+ solidity smart contract audits covering all major project types and protocols, securing a total of over $50 billion U.S. dollars in on-chain value!
Our firm is well-reputed in the community and is trusted as a top smart contract auditing company for the review of solidity code, no matter how complex. Our team of experienced solidity smart contract auditors performs audits for tokens, NFTs, crowdsales, marketplaces, gambling games, financial protocols, and more!

Contact us today to get a free quote for a smart contract audit of your project!

What is a SourceHat Audit?

Typically, a smart contract audit is a comprehensive review process designed to discover logical errors, security vulnerabilities, and optimization opportunities within code. A SourceHat Audit takes this a step further by verifying economic logic to ensure the stability of smart contracts and highlighting privileged functionality to create a report that is easy to understand for developers and community members alike.

How Do I Interpret the Findings?

Each of our Findings will be labeled with a Severity level. We always recommend the team resolve High, Medium, and Low severity findings prior to deploying the code to the mainnet. Here is a breakdown on what each Severity level means for the project:

• High severity indicates that the issue puts a large number of users' funds at risk and has a high probability of exploitation, or the smart contract contains serious logical issues which can prevent the code from operating as intended.
• Medium severity issues are those which place at least some users' funds at risk and has a medium to high probability of exploitation.
• Low severity issues have a relatively minor risk association; these issues have a low probability of occurring or may have a minimal impact.
• Informational issues pose no immediate risk, but inform the project team of opportunities for gas optimizations and following smart contract security best practices.

• Go Home