Bitcoin Bird (BTCBIRD) security report
Bitcoin Bird (BTCBIRD) was AI-scanned using its verified BSC source and supplied GoPlus evidence. Slither was not run. No Critical or High vulnerability was confirmed.
The contract is AI-scanned and verified source was reviewed. GoPlus reports no proxy, minting, blacklist, pause, self-destruct, honeypot, or buy restriction signals. The main risks are centralized migration control, potentially unsafe initialization parameters, external dividend-contract transfer dependencies, and owner concentration.
Trust score: 62/100. Source verified: Yes. Chain: bsc. Contract: 0x7e90ed2fd59a621e5058f4707269980f9d9a7777.
This report was last modified on 2026-09-29 and contains 4 material findings.
medium finding: Owner-controlled migration can restrict or alter pool trading behavior
The owner exclusively controls startMigration() and finalizeMigration(). While the token remains in BondingCurve state, transfers to or from every configured pool revert. After finalization, configured buy and sell taxes become active, and the owner cannot be compelled by the token contract to complete migration or follow a timelock.
Evidence: startMigration() and finalizeMigration() are both protected by onlyOwner. In _transfer(), BondingCurve requires !pools[from] && !pools[to], while finalizeMigration() transitions to TaxEnforcedAntiFarmer and applies the initialization tax rates.
Recommendation: Use a timelocked or multisignature migration controller, publish the intended state-transition process, validate that configured pools are correct, and provide monitoring for prolonged BondingCurve or Migrating states.
medium finding: Initialization accepts tax rates above 100%, enabling conditional trading reverts
The initializer accepts uint16 buy and sell tax values without enforcing a maximum of 10,000 basis points. A rate above 100% makes tax exceed the transferred amount for sufficiently large transfers, causing amount - tax to revert. A 100% rate transfers no net tokens to the recipient and can make practical buying or selling unusable depending on the router path.
Evidence: initialize() stores params.buyTax and params.sellTax directly in poolState. _getTaxWithPoolState() computes amount * rate / 10000, and _taxedTransfer() executes uint256 remainingAmount = amount - tax.
Recommendation: Enforce buyTax and sellTax <= 10000, preferably with a lower documented maximum, validate the deployed initialization values, and test router-compatible behavior for both buy and sell paths before launch.
medium finding: Dividend callback failure can block ordinary token transfers
When dividendContract is nonzero, every transfer involving a non-excluded address synchronously calls IDividend.setShare(). Any revert from that external contract is converted into DividendShareUpdateFailed and reverts the entire token transfer. A misconfigured, incompatible, or unavailable dividend contract can therefore cause a broad transfer denial of service.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)); both calls catch failures and revert with DividendShareUpdateFailed. initialize() does not validate that dividendContract implements the expected interface or remains available.
Recommendation: Add robust failure handling or an emergency-controlled fallback, validate the dividend contract during initialization, isolate reward accounting from core transfers where possible, and monitor callback failure events.
medium finding: Owner wallet holds a material portion of total supply
GoPlus reports the owner address holding approximately 29.877% of the total supply. A concentrated owner allocation creates meaningful market-impact and governance-centralization exposure if sold, transferred, or used in coordinated actions. This is a holder-risk observation, not evidence of theft or misconduct.
Evidence: GoPlus evidence: owner_address 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0; owner_balance 298769977.46494806; owner_percent 0.29877; total_supply 1000000000.
Recommendation: Disclose the allocation and vesting plan, consider multisignature custody and transparent vesting or distribution controls, and monitor large owner-address transfers.