Bau (BAU) security report
Radar AI scanned Bau (BAU) using the verified Solidity source and supplied GoPlus signals. The token has fixed initial supply and no detected mint, blacklist, tax, proxy, or owner-control functions. A high-severity transfer-path risk remains: every non-mint transfer calls an immutable external distributor without fail-open handling, so distributor reverts or selective restrictions could block transfers. Slither was not run.
The verified token is a fixed-supply ERC-20 with no apparent mint or owner-control functions, but every transfer depends on an external immutable distributor contract. If that distributor reverts or applies selective logic, transfers can be blocked, creating a conditional honeypot-like or asset-lock risk.
Trust score: 72/100. Source verified: Yes. Chain: ethereum. Contract: 0x27e9447922ec892f50d870abd6b4600cc03934a5.
This report was last modified on 2026-09-29 and contains 1 material finding.
high finding: External distributor can block all token transfers
The token delegates an external call to the immutable distributor during every non-mint transfer. A distributor contract that reverts, becomes dysfunctional, or selectively rejects addresses can cause the entire token transfer transaction to revert, potentially preventing holders from selling or moving BAU.
Evidence: LaunchToken._update calls super._update(from, to, value), then executes IHolderDistributor(distributor).onTransfer(...) whenever from != address(0) and distributor != address(0). The callback is not wrapped in try/catch, so any revert propagates and reverts the transfer. The distributor is assigned from the constructor and exposed as an immutable public value. The supplied GoPlus result reports is_honeypot=0 and transfer_pausable=0, but those signals do not remove the source-level dependency on the external callback. Slither was not run.
Recommendation: Verify the deployed distributor bytecode and its onTransfer implementation, including whether it can reject transfers based on sender, receiver, amount, or trading state. Consider removing the mandatory callback, limiting it to non-blocking accounting, or using a design where distributor failure cannot revert ERC-20 transfers. Monitor the immutable distributor for unexpected behavior.