Binance Accelerationism (b/acc) security report
Radar by SecureChain.ai AI-scanned the verified Binance Accelerationism b/acc contract on BSC. GoPlus found no minting, blacklist, pause, proxy, or honeypot signal. Slither was not run, and the live tax and pool-state values should be verified on-chain.
The contract does not expose post-initialization minting, blacklist, pause, or upgrade functions, and GoPlus reports is_honeypot=0. These are material medium-severity risks; current on-chain tax and pool-state values should be verified separately.
Trust score: 61/100. Source verified: Yes. Chain: bsc. Contract: 0x483f2dab2662c37eda5d858a15c16f36fc687777.
This report was last modified on 2026-09-26 and contains 3 material findings.
medium finding: Owner can keep pool transfers restricted by withholding migration
While poolState is BondingCurve, _transfer() requires both pools[from] and pools[to] to be false. Only the owner can call startMigration() and finalizeMigration(). If the owner does not advance the state, transfers to or from configured pools remain blocked, which can prevent normal DEX trading through those pools.
Evidence: _transfer() reverts with "Transfers to/from pools are restricted in BondingCurve state" when either endpoint is a configured pool. startMigration() and finalizeMigration() are both protected by onlyOwner.
Recommendation: Use a verifiable launch procedure with timelocks or a multisig, publish the intended pool-state transitions, and confirm the live poolState and migration status before trading.
medium finding: Initialization permits tax rates that can make pool transfers revert
initialize() accepts buyTax and sellTax as unrestricted uint16 values. _getTaxWithPoolState calculates tax as amount multiplied by the rate divided by 10000, while _taxedTransfer computes remainingAmount = amount - tax. A configured rate above 10000 basis points makes the subtraction revert for taxed pool transfers, creating a potential trading lock. The supplied GoPlus tax fields are blank, so the live configured rates were not established by the evidence provided.
Evidence: initialize() stores params.buyTax and params.sellTax without a <=10000 validation. _taxedTransfer() performs uint256 remainingAmount = amount - tax. GoPlus buy_tax, sell_tax, and transfer_tax fields are empty.
Recommendation: Enforce buyTax and sellTax <= 10000 during initialization, and independently verify the deployed buyTaxRate(), sellTaxRate(), and poolState() values.
medium finding: Configured dividend callback can block ordinary token transfers
When dividendContract is nonzero, _afterTokenTransfer() calls IDividend.setShare() for sender and recipient addresses that are not excluded. Any revert from either callback is propagated through DividendShareUpdateFailed, causing the entire token transfer to revert. Because dividendContract is set during initialization and there is no recovery setter in this contract, a misconfigured or unavailable dividend contract can materially impair transfers.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare(...) inside try/catch and explicitly reverts with DividendShareUpdateFailed on failure. initialize() assigns dividendContract from params without validating code, interface behavior, or availability.
Recommendation: Validate the dividend contract during initialization, add a controlled fail-open or emergency configuration path, and test transfers when the dividend dependency reverts or is unavailable.