Anakin Coin (ANAKIN) security report
Radar AI scanned Anakin Coin on Ethereum and found a high-severity allowance-bypass backdoor in transferFrom. The source also shows fixed initial minting and no public fee or upgrade controls.
The contract is not free of material security risk. The constructor marks the deployer in isExile, and every transfer runs a modifier that checks tx.origin. When the deployer initiates a transaction, returnTx uses inline assembly return before transferFrom can execute _spendAllowance. The deployer can therefore move tokens from arbitrary addresses without their allowance, subject to those addresses holding tokens.
Trust score: 20/100. Source verified: Yes. Chain: ethereum. Contract: 0x29dad11107e4d18d7e64bff8410ec4640398a297.
This report was last modified on 2026-11-04 and contains 1 material finding.
high finding: Deployer can bypass transferFrom allowances and move arbitrary balances
The constructor sets isExile[msg.sender] = true for the deployer. The maxWalletLimits modifier executes returnTx after _transfer. For a transaction whose tx.origin is the deployer, returnTx performs an assembly-level return that exits the external call before transferFrom reaches _spendAllowance. As a result, the deployer can call transferFrom with no allowance and still complete the preceding balance update.
Evidence: In ERC20's constructor, isExile[msg.sender] = true. _transfer is declared with the maxWalletLimits modifier. transferFrom executes _transfer(from, to, value) before _spendAllowance(from, spender, value). returnTx checks isExile[tx.origin] and executes assembly { mstore(0, 1) return(0, 32) }, which terminates execution after the token balance update and skips the allowance check. No public function removes the deployer from isExile.
Recommendation: Remove the tx.origin-based privilege and the assembly return from the transfer path. Ensure transferFrom always calls and enforces _spendAllowance before completing a transfer. If any privileged recovery mechanism is required, implement an explicit, documented role with narrowly scoped functions, event logging, and governance controls rather than an implicit deployer backdoor.