Delivery Girl (DGIRL) security report
Radar by SecureChain AI scanned Delivery Girl (DGIRL) on Base on September 30, 2026. The verified token source shows fixed supply and unrestricted transfers, while highlighting medium risks from initial launcher concentration and live external metadata.
The token contract itself has a fixed supply and unrestricted ERC-20 transfers, with no apparent owner-controlled tax, blacklist, pause, or post-deployment mint mechanism. GoPlus reports the contract as open source, non-proxy, non-mintable, non-blacklisted, non-pausable, and without detected buy or sell restrictions.
Trust score: 88/100. Source verified: Yes. Chain: base. Contract: 0x5309e203787a3644f436ed1b300dc985556f3dcc.
This report was last modified on 2026-09-30 and contains 1 material finding.
medium finding: Token metadata depends on a live external launcher URI
tokenURI() does not store an immutable metadata location. Each call queries launcher.baseTokenURI(), concatenates the current base with this contract address, and returns an empty string if the external call fails. If the launcher can change its base URI or becomes unavailable, displayed metadata can change or disappear without any change to this token contract.
Evidence: tokenURI() executes try IStonkLauncherBaseURI(launcher).baseTokenURI(), returns string.concat(base, _hexAddress(), ".json"), and catches all failures by returning "". The launcher is an external contract and its implementation is not included in the supplied source.
Recommendation: Review the launcher contract's authorization and baseTokenURI update logic. If stable metadata integrity is required, use an immutable or content-addressed URI, or document the launcher governance and failure behavior.