COOKIN (COOK) security report
Radar AI scanned COOKIN on BNB Smart Chain. The source shows no mint, blacklist, or upgrade path, but identifies buy-revert risk from unbounded tax parameters and launchpad control of collected tax tokens.
The source does not show a conventional honeypot, blacklist, post-deployment mint, or upgrade mechanism. However, malformed or overly aggressive deployment parameters can make buys revert, and the immutable launchpad can withdraw all accumulated tax tokens without an on-token guarantee that proceeds reach the creator or platform.
Trust score: 58/100. Source verified: Yes. Chain: bsc. Contract: 0x110e50db9950b8b98006a1a931d3f1d04f629941.
This report was last modified on 2026-10-08 and contains 2 material findings.
medium finding: Unbounded tax parameters can make token purchases revert
The constructor accepts creatorShareBps_ and snipeStartBps_ without validating that either value is within the intended basis-point range. Excessive values can cause arithmetic underflow in the buy path, reverting purchases from the bound pool.
Evidence: In _update, toCreator = (base * creatorShareBps) / BPS and toPlatform = base - toCreator + snipe. If creatorShareBps exceeds 10,000, base - toCreator underflows and every taxed pool transfer reverts. If snipeStartBps is sufficiently high, toCreator + toPlatform can exceed value during the surcharge period, causing value -= toCreator + toPlatform to revert. The constructor does not enforce bounds on either parameter or on the resulting total tax.
Recommendation: Validate creatorShareBps_ <= 10,000, constrain snipeStartBps_ so the maximum total tax cannot exceed 10,000 basis points, and require deployment-time invariants covering all combinations of base tax, creator share, and surcharge. Add tests for extreme values and buy behavior across the surcharge window.
medium finding: Launchpad has custodial control over collected tax tokens
The immutable launchpad is the only address allowed to withdraw accumulated creator and platform tax tokens. The token contract does not enforce conversion, distribution, recipient amounts, or a deadline after withdrawal, creating a material dependency on launchpad behavior.
Evidence: pullTax requires msg.sender == launchpad, copies creatorTaxHeld and platformTaxHeld, resets both balances, and calls super._update(address(this), launchpad, toCreator + toPlatform). The launchpad therefore receives all held tax tokens in one operation, while the token contract contains no subsequent settlement or payout verification.
Recommendation: Use a transparent settlement mechanism with verifiable recipient transfers, bounded withdrawal behavior, and documented recovery controls. If the launchpad must perform conversion, publish and audit that component, emit settlement records, and consider timelocks or constrained escrow for accumulated tax proceeds.