Alagael (ALAGAEL) security report
Radar by SecureChain AI scanned Alagael on Ethereum and found a high-severity transfer-availability risk caused by its immutable external distributor callback. No owner minting, dynamic fees, blacklist, or upgrade functions were identified in the supplied source.
Alagael has a material transfer-availability risk: every non-mint transfer calls an externally configured distributor, and a reverting distributor can block transfers. The supplied source does not show owner-controlled minting, dynamic fees, blacklist logic, or upgradeability.
Trust score: 55/100. Source verified: Yes. Chain: ethereum. Contract: 0x4bb8e07055d84b5b8c8f07aa012bd1d8e334f211.
This report was last modified on 2026-10-07 and contains 1 material finding.
high finding: Immutable external transfer hook can freeze token transfers
Every non-mint token movement depends on a call to the configured distributor contract. Because the callback is part of the transfer transaction, any revert or unavailable distributor causes the entire transfer to revert. If the distributor is nonzero and fails persistently, holders may be unable to transfer or sell tokens through standard ERC-20 methods.
Evidence: In LaunchToken._update, the contract first calls super._update(from, to, value), then executes IHolderDistributor(distributor).onTransfer(...) whenever from != address(0) and distributor != address(0). The distributor address is immutable and supplied in the constructor. Solidity reverts the complete transaction when this external call reverts, rolling back the preceding token state update.
Recommendation: Use a narrowly scoped, audited hook with a demonstrated non-reverting path, or isolate distributor accounting from ERC-20 transfer success. If the hook must remain synchronous, add a carefully designed emergency bypass or immutable fail-safe that cannot be abused to alter balances. Verify the deployed distributor implementation and its upgrade, pause, and revert behavior before relying on the token.