Bankereum (BANKEREUM) security report
Bankereum was AI scanned on Ethereum. The fixed-supply ERC-20 has no visible mint, blacklist, fee, or upgrade controls, but its immutable distributor callback can make transfers revert.
The verified source does not show an obvious minting backdoor, blacklist, configurable tax, or upgrade path. The main identified risk is the immutable external distributor callback in _update, which can block all non-mint transfers if the configured distributor reverts or behaves incompatibly. Slither was not run, and no GoPlus evidence was supplied.
Trust score: 78/100. Source verified: Yes. Chain: ethereum. Contract: 0x946be31a1ce0920f763e1fdae96c971cdccd037f.
This report was last modified on 2026-10-08 and contains 1 material finding.
medium finding: Immutable distributor callback can block token transfers
Every transfer, including transfers initiated through transferFrom, invokes the externally deployed distributor after balances are updated. Because the call is synchronous and its return value is not handled, any revert or failure in the distributor reverts the entire token transfer. The distributor address is immutable and cannot be replaced through this token contract.
Evidence: LaunchToken._update calls super._update(from, to, value), then, whenever from != address(0) and distributor != address(0), executes IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)). A reverting external call reverts the enclosing transaction. The constructor assigns distributor = distributor_ and exposes no setter or recovery function.
Recommendation: Before deployment, verify that the distributor address is the intended contract and that its onTransfer implementation is non-reverting for every supported transfer context. Consider a fail-open or carefully bounded callback design, or provide an audited recovery mechanism if the distribution architecture permits it. Because the address is immutable here, a faulty deployment cannot be repaired through LaunchToken.