DIAX (DIAX) security report
SecureChain AI scanned the verified DIAX source and reviewed GoPlus evidence. No Critical issue was proven, and GoPlus found no minting, blacklist, pause, proxy, or honeypot signal. Material risks include 68.31% owner supply concentration, approximately $17.3K reported liquidity, owner-controlled migration that can restrict pool transfers, and external dividend and tax-processor dependencies. Slither was not run.
No Critical vulnerability was proven from the supplied source and evidence. The main risks are severe holder concentration, owner-controlled migration that can restrict pool transfers while bonding-curve state is active, and external callback dependencies that can block transfers or redirect accumulated tax tokens if misconfigured or unavailable.
Trust score: 57/100. Source verified: Yes. Chain: bsc. Contract: 0xd9a093f9ac6b2ab0e2e15eaf83de3f5682a97777.
This report was last modified on 2026-09-19 and contains 4 material findings.
high finding: Extreme owner token concentration creates major dump and governance risk
The designated owner address holds approximately 68.31% of the one-billion-token supply. A large sale could severely impact price and liquidity, especially given the reported liquidity of approximately $17,301.12. The source does not impose vesting, timelocks, or transfer limits on the owner.
Evidence: GoPlus evidence reports owner_address 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0, owner_balance 683107839.4862444, and owner_percent 0.683108. The contract mints maxSupply to msg.sender during initialize and has no vesting or holder-concentration controls.
Recommendation: Disclose the owner allocation and intended selling policy, use verifiable vesting or lockups for material holdings, and materially increase and lock liquidity where appropriate. Monitor owner transfers and large exchange or pool deposits.
high finding: Owner-controlled migration can restrict pool transfers before migration completes
While the pool state is BondingCurve, every transfer involving any configured pool reverts. Only the owner can call startMigration and finalizeMigration, so the owner controls when pool trading is enabled and when the token enters its tax-enforced lifecycle. If the contract remains in BondingCurve, users may be unable to sell or add liquidity through configured pools.
Evidence: _transfer requires !pools[from] && !pools[to] in PoolState.BondingCurve. startMigration and finalizeMigration are both external onlyOwner functions. The supplied evidence does not include the current pool state, so the present impact cannot be confirmed.
Recommendation: Verify and publicly disclose the current state, migration conditions, and owner address. Use a permissionless or time-bounded migration path, or transfer control to a timelocked multisig with an independently verifiable completion process.
medium finding: Dividend callback can make ordinary transfers revert
When dividendContract is nonzero, every token transfer invokes IDividend.setShare for the sender and recipient unless they are excluded by address category. Any revert from either callback is caught and converted into DividendShareUpdateFailed, reverting the entire token transfer. A broken, incompatible, or unavailable dividend contract can therefore block transfers for affected users.
Evidence: _afterTokenTransfer calls IDividend(dividendContract).setShare(...) in try/catch and explicitly reverts on failure. dividendContract is set during initialize and there is no function to replace or disable it after initialization.
Recommendation: Use a tested and immutable-compatible dividend implementation, add operational monitoring, and consider making share updates non-blocking or adding a governed emergency bypass before deployment.
medium finding: Tax-processor failure sends the full accumulated token balance to the processor
If TaxProcessor.processTaxTokens reverts, the catch branch transfers the entire token balance held by the token contract, not merely the current taxAmount, to taxProcessor. This can include tax accumulated from multiple prior transactions. The configured processor therefore receives custody of all accumulated tax tokens whenever processing fails.
Evidence: In _processTax, the catch branch computes balanceOf(address(this)) and calls _plainTransfer(address(this), taxProcessor, remainingBalance). taxProcessor is configured during initialize and is not changeable through the exposed contract functions.
Recommendation: Limit the fallback transfer to the intended amount, use an explicitly audited processor, emit detailed failure accounting, and provide a controlled recovery or retry mechanism that does not transfer unrelated accumulated balances.