Core Contracts

Summary

The _update function incorrectly applies a tax when tokens are burned (to == address(0)). Since burning is meant to reduce supply, no tax should be deducted. This results in users losing more tokens than intended when burning, as a portion of the burn amount is taxed and sent to the fee collector instead of being fully removed from circulation.

Vulnerability Details

• When a user burns tokens (to == address(0)), the contract still applies a tax, which is incorrect since burning should not be taxed.

• As a result, users may lose more than the amount they intended to burn.

• Example: If a user burns 100 tokens with a 1% tax, they might only burn 99 tokens while still being taxed on the full 100.

Impact

users may lose more than the amount they intended to burn

Tools Used

Manual review

Recommendations

Exclude Burns (to == address(0)) from Taxation