Ethereum Dog (DOGGO) security report
Radar by SecureChain AI scanned Ethereum Dog's verified Ethereum contract. The source has standard ERC-20 behavior and no adjustable mint, tax, blacklist, or pause controls, but every non-mint transfer depends on an immutable external distributor callback that can revert transfers.
The verified source does not expose conventional honeypot controls, adjustable taxes, post-deployment minting, or upgradeability. However, the immutable distributor dependency can make all non-mint transfers revert if its callback fails or intentionally reverts. This is a medium-severity operational and control risk, not a confirmed exploit.
Trust score: 78/100. Source verified: Yes. Chain: ethereum. Contract: 0x55faf91966769f3b1e589642a5732a8eb24aebbf.
This report was last modified on 2026-10-07 and contains 1 material finding.
medium finding: Immutable external distributor callback can freeze token transfers
Every non-mint token transfer performs an external call to the constructor-supplied distributor. If that contract reverts, runs out of gas, or implements an incompatible callback, the entire token transfer reverts because the callback is part of the transfer transaction. The distributor address cannot be changed or disabled after deployment.
Evidence: In LaunchToken._update(), after super._update(from, to, value), the contract executes `IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to));` whenever `from != address(0)` and `distributor != address(0)`. The distributor is declared `immutable` and assigned from the constructor argument `distributor_`. The interface requires an external `onTransfer` function, but the token contains no failure isolation, fallback path, gas limit, or administrator-controlled disable switch.
Recommendation: Use a failure-isolated callback pattern, such as making the distributor call optional and handling failures without reverting transfers, or ensure the distributor is rigorously verified and permanently operational before deployment. Consider allowing a governed emergency disable or replacing the callback with a pull-based accounting design.