XMozToken permits transfers from non-whitelisted addresses
The XMozToken is documented to forbid transfers except from whitelisted addresses or mints.\\n```\\n        /**\\n        * @dev Hook override to forbid transfers except from whitelisted \\n        addresses and minting\\n        */\\n        function _beforeTokenTransfer(address from, address to, uint256 \\n        /*amount*/) internal view override {\\n                require(from == address(0) || _transferWhitelist.contains(from) \\n                  || _transferWhitelist.contains(to), "transfer: not allowed");\\n                 }\\n```\\n\\nHowever, as can be seen, non-whitelisted users can still transfer tokens, so long as it is to whitelisted destinations.
Remove the additional check in `_beforeTokenTransfer()`, or update the documentation accordingly.
```\\n        /**\\n        * @dev Hook override to forbid transfers except from whitelisted \\n        addresses and minting\\n        */\\n        function _beforeTokenTransfer(address from, address to, uint256 \\n        /*amount*/) internal view override {\\n                require(from == address(0) || _transferWhitelist.contains(from) \\n                  || _transferWhitelist.contains(to), "transfer: not allowed");\\n                 }\\n```\\n