SpaceXSI (SpaceXSI) security report
Radar AI scanned the verified SpaceXSI contract on BNB Smart Chain. The review found medium-severity risks involving unrecoverable native-currency deposits, hidden airdrop deductions during pair transfers, and privileged fee exemptions. No Slither scan was available.
SpaceXSI is not free of material contract risks. The main issues are permanently locked ETH sent to the contract, hidden extra deductions on buys and sells, and owner-controlled fee exemptions that can bypass certain trading controls before ownership is renounced.
Trust score: 63/100. Source verified: Yes. Chain: bsc. Contract: 0x8b431c93d804c345fae9a4598b20094598a9ffa1.
This report was last modified on 2026-10-07 and contains 3 material findings.
medium finding: ETH sent to the contract has no withdrawal path
The contract accepts native BNB through both receive() and deposits(), but the verified source contains no function that transfers or withdraws native currency. BNB sent to the contract can therefore become permanently inaccessible.
Evidence: Token.sol defines deposits() external payable and receive() external payable. The contract has no payable withdrawal function and no native-currency transfer operation elsewhere in the verified source.
Recommendation: Remove payable entry points if native currency is not required, or add a narrowly controlled withdrawal mechanism with documented authorization, event logging, and testing for accidental deposits.
medium finding: Pair transfers deduct hidden airdrop amounts from the sender
Transfers involving swapPair can deduct two additional amounts from the sender and send them to addresses derived from block.timestamp, the transfer amount, and an index. These deductions are separate from the advertised recipient amount and configured token fees.
Evidence: In _transfer(), when from == swapPair or to == swapPair, airdropNumbs defaults to 2. For each iteration, airdropAmount = amount / 10**9, the destination is derived with keccak256(abi.encodePacked(i, amount, block.timestamp)), and super._transfer(from, ad, airdropAmount) executes before the final transfer of amount - fees.
Recommendation: Remove the implicit airdrop behavior or disclose and bound it explicitly. If retained, use a deterministic, documented distribution mechanism and ensure callers can predict the total amount deducted before signing a trade.
medium finding: Owner-controlled fee exemptions can bypass trading checks and taxes
While ownership is active, the owner can mark arbitrary addresses as excluded from fees. Excluding the pair or a trading participant bypasses the conditional block that applies buy and sell fees; excluding the pair also bypasses the buy-side tradingEnabled and liquidity-removal checks because those checks require both addresses to be non-exempt.
Evidence: setTrailblazers(address[] accounts, bool flag) is onlyOwner and writes isExcludeFromFee. In _transfer(), fee logic and the buy-side checks execute only when !isExcludeFromFee[from] && !isExcludeFromFee[to]. GoPlus reports owner_address as the zero address, indicating the supplied scan evidence currently shows renounced ownership, but the verified code retains this privileged control before renunciation.
Recommendation: Document the exemption policy and emit auditable configuration events. If the intended deployment is permanently renounced, verify that state independently and consider removing privileged exemption logic in future deployments.