Smart Contract Audit Report

Description

At review time the owner/deployer address 0xD2eB…2c70 holds 950,046 TLC, about 95% of total supply. This is normal immediately after launch, but a single key controlling most of supply is a market and custody risk.

Impact

A large sale or a compromised private key could move the market sharply. This is an economic and operational risk; no code path is affected.

Recommendation

Move treasury funds to a multisig wallet (for example Safe), publish an allocation and vesting schedule, and lock liquidity once a DEX pair is created.

Team response

Acknowledged. Multisig treasury and published vesting are scheduled on the roadmap.

Description

mintExtra() lets the owner mint 500,000 TLC to itself, one time only. The extraMinted flag is set before minting and is never reset.

function mintExtra() public onlyOwner {
    require(!extraMinted, "Extra mint already done");
    extraMinted = true;
    _mint(msg.sender, EXTRA_MINT_AMOUNT);
}

Impact

Supply can grow by 50% at the owner's discretion, once. The ceiling is strictly bounded at 1,500,000 TLC and the flag is public, so anyone can check whether it has been used.

Recommendation

Announce any use in advance and route minted tokens into a vesting or timelock contract.

Positive note

Most BEP20 tokens keep an unlimited mint(). A single, hard-coded, single-use mint is a deliberate and much safer design.

Description

transferOwnership() sets the new owner immediately. A wrong address would permanently lose access to mintExtra and withdrawCoin. There is also no renounceOwnership.

Impact

Limited. Owner powers never touch holder balances, so a lost owner key affects only the reserve mint and token recovery.

Recommendation

Double-check the target address before any transfer, test with a small multisig first, and prefer a multisig as the owner.

Solidity 0.8+ already reverts on overflow, so SafeMath adds a second check, and the optimizer is disabled. Both slightly raise gas per transfer. Security is not affected; on BNB Chain the extra cost is a fraction of a cent.

The source uses pragma solidity >=0.8.14;. The deployed bytecode was compiled with the fixed version 0.8.26 (verified), so the live contract is unaffected. Pin an exact version in future contracts.

_burnFrom is internal and never called, so it is unreachable. No risk; dead code only.

Like every ERC20/BEP20 token, changing a non-zero allowance with approve can be front-run. TLC already ships increaseAllowance and decreaseAllowance, the standard mitigation.

OwnershipTransferred parameters are not indexed, and the constructor sets the first owner without emitting it. Indexers have to read owner() directly. No security effect.

function withdrawCoin(uint256 amount) public onlyOwner {
    _transfer(address(this), msg.sender, amount);
}

This only moves TLC that sits at the contract's own address, typically tokens users sent there by mistake. It cannot move tokens from any holder wallet. A safe and user-friendly recovery path. Current contract balance: 0 TLC.