BluePerp (BERP) security report
BluePerp was AI scanned from verified source and supplied GoPlus evidence. No Critical or High issues were found. The fixed-supply token has no mint, tax, blacklist, pause, or owner administration. A Medium risk remains because the constructor grants Permit2 an unlimited allowance over the deployer's balance. Slither was not run.
No Critical or High exploit was identified. The main material risk is an unlimited Permit2 allowance assigned to the deployer during construction, creating an external dependency and a potential full-balance transfer path if Permit2 or the deployer's Permit2 authorization is compromised. GoPlus reports no minting, blacklist, pause, tax, proxy, or honeypot indicators.
Trust score: 86/100. Source verified: Yes. Chain: base. Contract: 0xf76c32a6dab837756e327551dfdcd15fc732b750.
This report was last modified on 2026-09-23 and contains 1 material finding.
medium finding: Unlimited Permit2 allowance is granted to the deployer
The constructor permanently sets allowance[msg.sender][PERMIT2] to type(uint256).max. This authorizes the canonical Permit2 contract to act as an approved spender for the deployer's entire token balance, including tokens the deployer may receive or retain after deployment. Any risk in Permit2, its authorization model, or the deployer's Permit2 signing and account security could expose that balance to unauthorized transfers.
Evidence: Verified source constructor: allowance[msg.sender][PERMIT2] = type(uint256).max; PERMIT2 is hardcoded as 0x000000000022D473030F116dDEE9F6B43aC78BA3. transferFrom skips allowance reduction when the allowance equals uint256 max. GoPlus reports external_call=0 and no owner controls, but does not negate the explicitly configured token allowance.
Recommendation: Remove the automatic unlimited allowance unless Permit2 integration is required. Prefer requiring an explicit user approval, using a bounded allowance, or documenting and monitoring the Permit2 dependency. The deployer should revoke the allowance with approve(PERMIT2, 0) when Permit2 is not actively needed.