CoinMarketCat (CMC) security report
CoinMarketCat was AI scanned using verified Solidity source and GoPlus evidence. Slither was not run. GoPlus reports no proxy, blacklist, minting, or honeypot signal.
The contract is not an unrestricted ERC-20. The owner controls migration into the tradable pool states, and transfers can revert whenever the configured dividend contract rejects share updates. GoPlus reports no current honeypot, blacklist, minting, or proxy indicators, but these controls create material business-logic and centralization risks.
Trust score: 58/100. Source verified: Yes. Chain: bsc. Contract: 0x1d7a8bac5458bf5274656ca704b02a9d4c2f7777.
This report was last modified on 2026-09-29 and contains 4 material findings.
high finding: Owner can indefinitely prevent pool trading before migration
While the token remains in BondingCurve state, every transfer involving any configured pool reverts. Only the owner can call startMigration(), and only the owner can call finalizeMigration(). Therefore, the owner can keep pool buys and sells disabled indefinitely by not starting migration.
Evidence: In _transfer(), PoolState.BondingCurve requires !pools[from] && !pools[to]. startMigration() and finalizeMigration() are both external onlyOwner functions. GoPlus reports cannot_buy=0 and is_honeypot=0, but those signals do not remove the source-level owner gating risk.
Recommendation: Use an immutable or publicly verifiable launch schedule, permissionless or timelocked migration finalization where appropriate, and publish the configured pool and migration state. Monitor owner actions before trading is enabled.
high finding: Dividend callback can lock ordinary token transfers
When dividendContract is nonzero, every transfer involving a non-excluded non-pool address calls IDividend.setShare(). Any revert from that external call causes DividendShareUpdateFailed and reverts the entire token transfer. A broken, paused, malicious, or incompatible dividend contract can therefore block transfers between users, with no token-side setter to disable or replace the dependency.
Evidence: _afterTokenTransfer() calls setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) inside try/catch blocks and explicitly reverts on failure. The dividendContract is assigned during initialize() and has no public update or disable function in the verified source.
Recommendation: Make dividend accounting non-blocking, isolate callbacks from token transfers, add a fail-open or retry mechanism, and provide governed recovery for a broken dividend contract before deployment.
medium finding: Initialization assigns the full fixed supply and owner control to the initializer caller
initialize() mints maxSupply, equal to 1 billion tokens, directly to msg.sender and initializes ownership to the same caller through __Ownable_init(). If a proxy or clone deployment is not initialized atomically, an unintended caller could acquire the entire supply and owner privileges.
Evidence: initialize() calls __Ownable_init() and _mint(msg.sender, maxSupply). The initializer is externally callable once. The implementation constructor disables initialization, but safe proxy or clone deployment still requires initialization to be executed atomically.
Recommendation: Initialize the deployed instance in the same transaction as proxy or clone creation, verify the owner and initial recipient immediately, and use deployment tooling that rejects uninitialized instances.
medium finding: Owner-held supply creates material concentration and sell-pressure risk
GoPlus reports that the owner address holds approximately 0.440793 of total supply. The contract does not provide vesting, timelocks, or transfer limits for the owner balance. A large owner-controlled balance can materially affect market price and circulating supply if transferred or sold.
Evidence: GoPlus owner_address is 0xe2ce6ab80874fa9fa2aae65d277dd6b6b?; supplied evidence reports owner_balance=440792684.12482727 and owner_percent=0.440793. The source mints the full maxSupply to the initializer caller and contains no vesting or lock mechanism.
Recommendation: This finding is a concentration risk, not a claim about current market conditions.