IOTX [Binance-Peg IoTeX Network] Token

Modifier TransparentUpgradeableProxy.ifAdmin() (#366-372) does not always execute _; or revert
All the paths in a modifier must execute _ or revert.

Additional information: link

TransparentUpgradeableProxy.constructor(address,address,bytes)._admin (#346) shadows:
- TransparentUpgradeableProxy._admin() (#439-445) (function)
BEP20UpgradeableProxy.constructor(address,address,bytes).admin (#475) shadows:
- TransparentUpgradeableProxy.admin() (#383-385) (function)
Rename the local variables that shadow another component.

Additional information: link

Address._functionCallWithValue(address,bytes,uint256,string) (#207-228) is never used and should be removed
Address.functionCall(address,bytes) (#167-169) is never used and should be removed
Address.functionCall(address,bytes,string) (#177-179) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256) (#192-194) is never used and should be removed
Address.functionCallWithValue(address,bytes,uint256,string) (#202-205) is never used and should be removed
Address.sendValue(address,uint256) (#141-147) is never used and should be removed
Proxy._implementation() (#49) is never used and should be removed
Remove unused functions.

Additional information: link

TransparentUpgradeableProxy.upgradeToAndCall(address,bytes).newImplementation (#429) lacks a zero-check on :
- (success) = newImplementation.delegatecall(data) (#432)
UpgradeableProxy.constructor(address,bytes)._logic (#255) lacks a zero-check on :
- (success) = _logic.delegatecall(_data) (#260)
Check that the address is not zero.

Additional information: link

Proxy._delegate(address) (#23-43) uses assembly
- INLINE ASM (#25-42)
Address.isContract(address) (#114-123) uses assembly
- INLINE ASM (#121)
Address._functionCallWithValue(address,bytes,uint256,string) (#207-228) uses assembly
- INLINE ASM (#220-223)
UpgradeableProxy._implementation() (#280-286) uses assembly
- INLINE ASM (#283-285)
UpgradeableProxy._setImplementation(address) (#301-310) uses assembly
- INLINE ASM (#307-309)
TransparentUpgradeableProxy._admin() (#439-445) uses assembly
- INLINE ASM (#442-444)
TransparentUpgradeableProxy._setAdmin(address) (#450-457) uses assembly
- INLINE ASM (#454-456)
Do not use evm assembly.

Additional information: link

Different versions of Solidity is used:
- Version used: ['^0.6.0', '^0.6.2']
- ^0.6.0 (#5)
- ^0.6.2 (#91)
- ^0.6.0 (#235)
- ^0.6.0 (#317)
- ^0.6.0 (#470)
Use one Solidity version.

Additional information: link

Pragma version^0.6.0 (#5) allows old versions
Pragma version^0.6.2 (#91) allows old versions
Pragma version^0.6.0 (#235) allows old versions
Pragma version^0.6.0 (#317) allows old versions
Pragma version^0.6.0 (#470) allows old versions
solc-0.6.4 is not recommended for deployment
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

Low level call in Address.sendValue(address,uint256) (#141-147):
- (success) = recipient.call{value: amount}() (#145)
Low level call in Address._functionCallWithValue(address,bytes,uint256,string) (#207-228):
- (success,returndata) = target.call{value: weiValue}(data) (#211)
Low level call in UpgradeableProxy.constructor(address,bytes) (#255-263):
- (success) = _logic.delegatecall(_data) (#260)
Low level call in TransparentUpgradeableProxy.upgradeToAndCall(address,bytes) (#429-434):
- (success) = newImplementation.delegatecall(data) (#432)
Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence

Additional information: link

Unable to find audit link on the website