Case Study: BSC Governance Token Audit — 100% Tax Enabled and Unlimited Mint Authority

What We Found

One single person controls every important setting with no delays, no second approvals, and no safety checks. If that person's account is ever hacked, they can immediately redirect all fees, set taxes to 100%, and effectively steal from every user.

Why It Matters

A single compromised or malicious key can immediately alter all fee rates, tax rates, minter lists, and ownership, causing total loss of funds for all token holders.

What Should Be Done

Migrate all admin functions behind a multisig wallet and implement timelocks — a minimum 48-hour delay — on all parameter changes so that token holders can detect and react to malicious actions before they take effect.

What We Found

The administrator can set the transaction tax to 100%, meaning anyone buying or selling would have their entire transaction amount taken as a fee. The contract already starts with a 99.99% buy tax.

Why It Matters

Any buy or sell transaction can be taxed at 100%, transferring the full transaction value to the fee recipient and leaving the trader with nothing.

What Should Be Done

Implement a hard-coded maximum tax rate — for example 10% — using a constant rather than a configurable parameter, and add a require statement that prevents any rate from being set above that ceiling.

What We Found

Two specific external accounts have the permanent ability to create unlimited new tokens at any time, with no maximum limit.

Why It Matters

Authorized minters can inflate the token supply without bound, diluting all existing holders to near-zero value instantly.

What Should Be Done

Define an immutable maximum supply constant, enforce it inside the mint function, and require multisig approval before adding new addresses to the authorized minters list.

What We Found

The person who controls this contract can accidentally hand over permanent control to a wrong address with a single mistaken action, and there is no way to undo it.

Why It Matters

Ownership can be permanently transferred to an invalid or attacker-controlled address in a single transaction, locking all administrative functions or handing control to an adversary.

What Should Be Done

Implement a two-step ownership transfer pattern — propose a new owner, then require the new owner to accept — and add an explicit check that rejects the zero address as a transfer target.