Formion (FOM) security report
Formion was AI scanned on Base using verified source and supplied GoPlus evidence. No critical or high findings were identified. The verified token has fixed supply and standard transfers, but its entire initial supply is assigned to a deployment-supplied distribution address, creating a medium-severity governance and custody risk. Slither was not run.
No critical or high-severity vulnerability was identified in the verified Formion token source. The main material risk is medium severity: the constructor assigns the complete fixed supply to an address selected at deployment, so distribution depends on that address's controls and operational security.
Trust score: 92/100. Source verified: Yes. Chain: base. Contract: 0xdf1202b33255dd266bd5704e909ce8a72ba1e4d1.
This report was last modified on 2026-10-15 and contains 1 material finding.
medium finding: Entire initial supply is assigned to a deployment-supplied distribution address
The constructor mints the full fixed supply to the address passed as distributionSafe. The token contract does not enforce vesting, timelocks, allocation limits, or a particular multisignature implementation, so control over initial distribution is concentrated in that external address and its operators.
Evidence: In src/FOM.sol, constructor(address distributionSafe) checks only that the address is nonzero and then executes _mint(distributionSafe, TOTAL_SUPPLY). TOTAL_SUPPLY is 1,000,000,000 * 1e18. There are no later mint, pause, blacklist, tax, ownership, or upgrade functions in FOM.
Recommendation: Document and independently verify the distributionSafe governance, signer policy, spending limits, and distribution schedule. Where appropriate, use audited vesting or timelock contracts and publish allocation and transfer controls so the initial supply cannot be redistributed solely through an inadequately governed address.