DEBTCATS (DEBTCATS) security report
SecureChain AI scanned the verified DEBTCATS source and GoPlus evidence. No confirmed direct theft, post-deployment minting, blacklist, proxy, or honeypot path was found. Slither was not run.
The verified contract was AI scanned. No confirmed direct theft or mint-after-deployment path was found, and GoPlus reports no honeypot, mintability, blacklist, proxy, or transfer-pausability signals.
Trust score: 62/100. Source verified: Yes. Chain: bsc. Contract: 0x3247eb7f374c57ef267c12f4abc3f31c2a907777.
This report was last modified on 2026-09-29 and contains 3 material findings.
medium finding: Initialization permits tax rates above 100%, potentially locking pool trading
The initializer accepts buyTax and sellTax as uint16 values but does not enforce a maximum of 10,000 basis points. If either rate exceeds 100%, _taxedTransfer calculates a tax greater than the transfer amount and amount - tax reverts. Once tax enforcement begins, buys or sells involving configured pools can therefore become unexecutable.
Evidence: initialize() stores params.buyTax and params.sellTax without validation. _getTaxWithPoolState() computes (amount * rate) / 10000, while _taxedTransfer() executes uint256 remainingAmount = amount - tax. The supplied runtime tax rates were not provided, so the deployed configuration could not be confirmed from the evidence.
Recommendation: Validate buyTax and sellTax <= 10000 during initialization, expose the deployed pool state and rates, and test buy and sell execution against the live configuration before relying on the token for trading.
medium finding: All ordinary transfers can depend on an external dividend callback
When dividendContract is nonzero, every transfer involving a non-excluded address calls IDividend.setShare. Any revert from that external contract is propagated through DividendShareUpdateFailed, reverting the token transfer. A malfunctioning, misconfigured, or intentionally reverting dividend contract can therefore disrupt transfers, including trading transactions.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare() for sender and recipient and explicitly reverts when either call fails. The dividendContract address is supplied during initialize() and is not changeable through any public function in the reviewed token source.
Recommendation: Use a trusted and independently audited dividend contract, add operational monitoring, and consider isolating share-accounting failures from ERC20 transfers or providing a controlled recovery mechanism.
medium finding: Owner-controlled migration can keep pool transfers restricted
While the token remains in BondingCurve state, transfers to or from every configured pool revert. Only the owner can call startMigration() and finalizeMigration() to advance the state. This creates a centralized liveness dependency and, if ownership was renounced before migration completed, could leave configured pool trading permanently restricted.
Evidence: _transfer() requires !pools[from] && !pools[to] in BondingCurve state. startMigration() and finalizeMigration() are both onlyOwner. GoPlus reports owner_address as the zero address, but the supplied evidence does not include the live poolState value or migration history, so a permanent lock is not proven.
Recommendation: Verify the live state(), configured pools, ownership history, and migration events. Complete migration before renouncing ownership, or add a permissionless and safely bounded state-transition mechanism in future deployments.