BCRank Coin (BCRC) security report
Radar AI scanned BCRank Coin on Polygon PoS and found a high-severity owner pause control plus medium-severity treasury and initial-distribution risks.
The contract has material centralized-control risks. The owner can pause all token transfers and approvals, potentially locking token movement, and can redirect future monthly minting to a selected treasury address. No proxy upgrade mechanism, blacklist, transfer tax, or honeypot path was identified in the supplied source.
Trust score: 48/100. Source verified: Yes. Chain: polygon. Contract: 0xa64657d89dd444ec8aac8dad055d2a93cae2bbba.
This report was last modified on 2026-10-01 and contains 3 material findings.
high finding: Owner can globally pause token transfers and approvals
The owner can invoke pause(), and transfer, transferFrom, and approve are all protected by whenNotPaused. A pause therefore prevents ordinary token movement and allowance changes until the owner calls unpause().
Evidence: BCRankCoin.pause() is external onlyOwner and calls _pause(). The overridden transfer(), transferFrom(), and approve() functions each use the whenNotPaused modifier. GoPlus independently reports transfer_pausable as 1.
Recommendation: Use a multisignature owner and publish explicit pause criteria, response procedures, and an unpause commitment. Consider limiting pause duration or scope so ordinary token transfers cannot be indefinitely blocked by one privileged account.
medium finding: Owner controls the destination of scheduled token issuance
The contract can mint a fixed monthly amount after each 30-day interval, and the minted tokens are sent to the mutable treasury address. Because updateTreasury() is owner-only, the owner can redirect all future scheduled issuance before any caller triggers mintMonthlySupply().
Evidence: mintMonthlySupply() calls _mint(treasury, mintAmount), where mintAmount is MONTHLY_MINT_AMOUNT multiplied by elapsed intervals. updateTreasury(address) is external onlyOwner and changes treasury to any nonzero address. MONTHLY_MINT_AMOUNT is 31,000 tokens per interval and there is no lifetime cap in the shown contract.
Recommendation: Use a timelocked or multisignature treasury change, emit and monitor TreasuryUpdated, and define a documented maximum issuance or governance-controlled issuance schedule if the token economics require a hard cap.
medium finding: Initial supply distribution is controlled by a single owner-selected sale address
The owner alone executes the one-time distribution and chooses the saleContract recipient. The selected address receives the complete initial sale allocation, while the owner allocation is also sent to the immutable deployer address. A mistaken or undisclosed saleContract selection can materially alter the intended distribution.
Evidence: executeInitialDistribution(address saleContract) is external onlyOwner, accepts any nonzero address, and transfers INITIAL_SALE_ALLOCATION of 499,500,000 tokens to that address. The function can be executed only once, so the selected destination cannot be corrected through this contract.
Recommendation: Require multisignature or timelocked approval for the distribution, publish and verify the intended sale-contract address before execution, and add deployment safeguards that restrict the recipient to an approved contract when appropriate.