Fly (Fly) security report
SecureChain AI scanned Fly’s verified Solidity source and supplied GoPlus data. The fixed-supply ERC20 has no detected mint, tax, blacklist, pause, upgrade, or honeypot controls. No critical or high findings were identified. Medium risks are concentrated initial supply and very limited reported liquidity or DEX presence. Slither was not run.
The verified contract appears technically simple and non-honeypot-like based on the supplied source and GoPlus evidence. No critical or high findings were found. Two medium business and control risks remain: the entire fixed supply is assigned to one constructor recipient, and GoPlus reports no DEX listing or holders while reported liquidity is only $9,668.58. Slither was not run, so this review does not include completed Slither analysis.
Trust score: 82/100. Source verified: Yes. Chain: bsc. Contract: 0x448dfcd74746c70c93af30212e1cd23533b47986.
This report was last modified on 2026-09-19 and contains 2 material findings.
medium finding: Entire token supply is initially concentrated in one recipient
The constructor mints the full configured supply to a single recipient address with no vesting, allocation limits, lockup, or distribution mechanism. A recipient controlling the initial supply could materially affect market price and circulating supply through selling or transfers.
Evidence: BrewToken constructor calls `_mint(recipient_, totalSupply_)`, assigning all minted tokens to the supplied `recipient_` address. No later vesting, timelock, governance, or distribution controls are present. GoPlus reports an owner balance of zero, but that signal does not establish how the constructor recipient distributed the supply.
Recommendation: Verify the constructor recipient, current balances, and transfer history on-chain. If the project relies on treasury or team allocations, publish allocation and vesting information and consider independently enforced locks for concentrated holdings.
medium finding: Very limited observed liquidity and trading presence
The supplied market data indicates limited liquidity and no detected DEX presence or holders. This can create substantial slippage, price volatility, and difficulty exiting positions even though the token transfer code itself does not impose a sell restriction.
Evidence: Project data reports liquidityUsd of 9668.58. GoPlus reports `is_in_dex: 0` and `holder_count: 0`. GoPlus also reports `cannot_buy: 0`, `cannot_sell_all: 0`, `buy_tax: 0`, `sell_tax: 0`, and `is_honeypot: 0`, so the risk is market liquidity rather than a demonstrated transfer honeypot.
Recommendation: Confirm the active liquidity pool, reserves, pair address, and holder indexing independently before trading. Treat low liquidity as a material execution and price-impact risk and avoid relying solely on automated honeypot indicators.