ETHICS (JUSTICE ) security report
SecureChain AI Radar AI-scanned the verified ETHICS JUSTICE token source and supplied GoPlus evidence. Material risks include owner pause authority, conditional minting to the cap, 50% owner concentration, and nearly all LP tokens held unlocked by the owner-linked address. GoPlus reports zero buy, sell, and transfer tax, no blacklist, no honeypot signal, and no proxy indicator. Slither was not run.
The contract was AI scanned using the verified source, ABI, and supplied GoPlus evidence. No direct source-level theft function or transfer tax was found, but owner-controlled pausing, mint authority, concentrated ownership, and effectively unlocked liquidity create significant loss and control risks.
Trust score: 32/100. Source verified: Yes. Chain: ethereum. Contract: 0x69db04251ed748705d50796e9758ab5dd2b000e9.
This report was last modified on 2026-09-19 and contains 6 material findings.
high finding: Owner can pause all token transfers
The owner can activate Pausable, and the overridden _update function applies whenNotPaused to transfers, minting, and burning. A pause prevents ordinary holders from transferring or selling tokens until the owner unpauses them.
Evidence: UltimateTokenOwnable.pause() is public onlyOwner and calls _pause(). UltimateTokenOwnable._update(...) uses the whenNotPaused modifier. GoPlus reports transfer_pausable=0, which conflicts with the verified source; the source provides the stronger evidence for this capability.
Recommendation: Require a timelock, multisignature control, transparent emergency-pause policy, and on-chain monitoring for pause and unpause events. Confirm the live owner and paused state independently.
high finding: Owner-controlled minting can dilute holders
The owner can call mint(address,uint256) to create tokens until the configured ERC20 cap is reached. If the cap exceeds current total supply, the owner can materially increase supply and dilute existing holders, including liquidity providers.
Evidence: The source defines function mint(address to, uint256 amount) public onlyOwner and calls _mint(to, amount). ERC20Capped only rejects supply above cap. The ABI exposes mint and cap. GoPlus reports is_mintable=0, but that signal does not remove the source-level owner mint capability or establish that current supply equals the cap.
Recommendation: Verify the live cap and totalSupply, disclose remaining mint capacity, and place mint authority under a multisig or permanently renounce it if no further issuance is intended.
high finding: Nearly all liquidity appears controlled by the owner and is unlocked
The Uniswap LP position is highly concentrated in one address, and the reported LP holder is not marked locked. Because that address matches the token owner and creator, the owner appears able to withdraw or materially reduce the pool liquidity, causing severe price impact and potential inability to exit.
Evidence: GoPlus reports LP holder 0x1cc53196fd03cb2d0fc619f4c3546afcc38bce57 with 7071.067811865475243008 LP tokens and 99.9999999999999999% of LP supply, is_locked=0. The same address is reported as owner_address and creator_address, with 50% of token supply. Reported liquidity is only approximately $13,241.13 for the project.
Recommendation: Use a verifiable time-locked or burn-address LP position, disclose the LP controller, and monitor withdrawals or transfers of the LP tokens. Treat the current pool as exposed to centralized liquidity withdrawal risk.
medium finding: Extreme token-holder concentration creates material market and governance risk
One address holds 50% of the reported 100,000,000 token supply, while the Uniswap pair holds approximately 45.32%. The non-LP holder concentration gives the owner substantial ability to create selling pressure, influence market price, or dominate informal governance and distribution decisions.
Evidence: GoPlus reports owner_balance=50000000 and owner_percent=0.5. The same address is identified as creator and owner. The holder count is only 8, and the owner position is reported as unlocked.
Recommendation: Publish a vesting or distribution schedule, use transparent multisignature treasury controls, and disclose whether the owner allocation is actively tradable or subject to contractual restrictions.
medium finding: Owner can change token metadata after deployment
The owner can replace tokenURI and contractURI data at any time. If users rely on the metadata for project identity, branding, or disclosures, this creates a centralized content-integrity and phishing risk.
Evidence: The source defines setTokenURI(string calldata tokenUri_) public onlyOwner and ERC20TokenMetadata returns the same stored URI from tokenURI() and contractURI().
Recommendation: Make metadata immutable where possible, or govern changes through a timelock and emit or document an explicit metadata-change policy.
medium finding: Initialization relies on external deployment sequencing
The contract uses an external initialize function that assigns the owner, mint target, supply, cap, decimals, and metadata. If a deployment or proxy setup leaves the contract uninitialized, the first caller could select these critical parameters. The supplied GoPlus result says the deployed address is not a proxy, but deployment sequencing should still be verified from transaction history.
Evidence: initialize(...) is external and protected only by OpenZeppelin's one-time initializer modifier. It accepts _owner, _mintTarget, _initialSupply, and _maxSupply. The source does not include a constructor calling _disableInitializers(). GoPlus reports is_proxy=0, and no direct evidence supplied here proves the initialization transaction was atomically secured.
Recommendation: Verify the deployment and initialization transaction, confirm the live owner, cap, mint recipient, and initialized version, and use atomic initialization data for any future factory or proxy deployment.