MEX [MetaXenon] Token

MetaXenon.airdrop(address) (#436-446) sends eth to arbitrary user
Dangerous calls:
- address(uint160(_refer)).transfer(referEth) (#443)
Ensure that an arbitrary user cannot withdraw unauthorized funds.

Additional information: link

Unable to find manual contract audit (e.g. Certik, PeckShield, Solidity...)

Contract ownership is not renounced (belongs to a wallet)

MetaXenon.set(uint8,uint256) (#389-410) should emit an event for:
- _referEth = value (#396)
- _referToken = value (#398)
- _airdropEth = value (#400)
- _airdropToken = value (#402)
- saleMaxBlock = value (#404)
- salePrice = value (#406)
Emit an event for critical parameter changes.

Additional information: link

SafeMath.sub(uint256,uint256) (#43-46) is never used and should be removed
SafeMath.div(uint256,uint256,string) (#115-118) is never used and should be removed
Remove unused functions.

Additional information: link

Parameter MetaXenon.buy(address)._refer (#448) is not in mixedCase
Parameter MetaXenon.airdrop(address)._refer (#436) is not in mixedCase
Follow the Solidity naming convention.

Additional information: link

MetaXenon._name (#149) should be constant
MetaXenon._symbol (#150) should be constant
MetaXenon._totalSupply (#148) should be constant
MetaXenon._decimals (#151) should be constant
Add the constant attributes to state variables that never change.

Additional information: link

solc-0.6.8 is not recommended for deployment
Pragma version0.6.8 (#2) allows old versions
Deploy with any of the following Solidity versions: 0.5.16 - 0.5.17, 0.6.11 - 0.6.12, 0.7.5 - 0.7.6 Use a simple pragma version that allows any of these versions. Consider using the latest version of Solidity for testing.

Additional information: link

MetaXenon.slitherConstructorVariables() (#145-464) uses literals with too many digits:
- _airdropToken = 2500000000000000000000 (#160)
MetaXenon.slitherConstructorVariables() (#145-464) uses literals with too many digits:
- _airdropEth = 2000000000000000 (#159)
MetaXenon.slitherConstructorVariables() (#145-464) uses literals with too many digits:
- _totalSupply = 100000000000000000000000000000 (#148)
MetaXenon.slitherConstructorVariables() (#145-464) uses literals with too many digits:
- salePrice = 2500000 (#166)
Use: Ether suffix, Time suffix, or The scientific notation

Additional information: link

cap() should be declared external:
- MetaXenon.cap() (#248-250)
clearETH() should be declared external:
- MetaXenon.clearETH() (#360-364)
transferFrom(address,address,uint256) should be declared external:
- MetaXenon.transferFrom(address,address,uint256) (#342-346)
getBlock() should be declared external:
- MetaXenon.getBlock() (#425-434)
transfer(address,uint256) should be declared external:
- MetaXenon.transfer(address,uint256) (#420-423)
name() should be declared external:
- MetaXenon.name() (#206-208)
allowance(address,address) should be declared external:
- MetaXenon.allowance(address,address) (#269-271)
set(uint8,uint256) should be declared external:
- MetaXenon.set(uint8,uint256) (#389-410)
balanceOf(address) should be declared external:
- MetaXenon.balanceOf(address) (#262-264)
approve(address,uint256) should be declared external:
- MetaXenon.approve(address,uint256) (#355-358)
decimals() should be declared external:
- MetaXenon.decimals() (#241-243)
totalSupply() should be declared external:
- MetaXenon.totalSupply() (#255-257)
setAuth(address,address) should be declared external:
- MetaXenon.setAuth(address,address) (#288-293)
transferOwnership(address) should be declared external:
- MetaXenon.transferOwnership(address) (#283-286)
buy(address) should be declared external:
- MetaXenon.buy(address) (#448-462)
authNum(uint256) should be declared external:
- MetaXenon.authNum(uint256) (#273-277)
symbol() should be declared external:
- MetaXenon.symbol() (#221-223)
airdrop(address) should be declared external:
- MetaXenon.airdrop(address) (#436-446)
Use the external attribute for functions never called from the contract.

Additional information: link

Token seems to be untradeable: there is no PancakeSwap trading pair and no trading volumes. Ignore for presale.

Token has no transactions for more than 100 days. It seems dead / abandoned.

Unable to find website, listings and other project-related information

Token has a considerable age, but we're still unable to find its website

Token has a considerable age, but average PancakeSwap 30d trading volume is low

Token has no active CoinGecko listing / rank

Token has no active CoinMarketCap listing / rank

Token has a considerable age, but social accounts / website are missing or have few users

Token is marked as risky (blacklisted creator, fake name, dead project, etc.)

Additional information: link