Read the findings of the 2022 Web3 Security Report

In the contract `MetaThai` the role `_owner` has authority over the functions shown in the diagram below.
![](https://accelerator-tasks-prod.s3.amazonaws.com/6c0c95c1573d4b53adfab503da2e7451/diagrams/centralization_MetaThai__owner.svg)

Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and
- update the `swapEnabled` through `toggleSwap()`
- set `marketingAddress` and `taxAddress` through `setAddress()`
- exclude or include an account in `_isExcludedFromFee` list
- withdraw all the ETH/BNB in this contract through `withdraw()`
- transfer ownership through `transferOwnership()`
- permanently give up ownership through `renounceOwnership()`

Centralization Risks in MetaThai.sol

All of the tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Initial Token Distribution

The contract is serving as the underlying entity to interact with third-party protocols. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets.

Third Party Dependencies

When `marketingAddress` or `taxAddress` is updated, the exemption from fees is not retracted from the previous addresses nor is it granted to the new ones.
A similar issue could apply to the owner address.

Privilege not Revoked or Transferred

The given input fee rates are missing the check that the sum of all fees should be below one hundred percent.

Missing Input Validation for Fees

The linked variables could be declared as constant since these state variables are never modified.


Variables That Could Be Declared as `constant`

The aforementioned line declares variablesof type bool and initialize it with false . In Solidity, all un-initialized
variables have a default value which for the bool variable is false , hence the initialization part is redundant and
can be removed.

Redundant initialization with default value

The given input is missing the check for the non-zero address.

Missing Input Validation

Literals with many digits are difficult to read and review.

Too Many Digits

The `onlyDev` modifier seems to serve the same purpose of `onlyOwner`, which makes it seems redundant.

Use of `onlyDev()`

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 

Function Visibility Optimization

The `_swapFee` and `_taxFee` are set then reset in the linked statements, which makes one of these assignments redundant.

Redundant Assignment 

METAThaicoin

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

12

0

12

0

0