GavCoin (GAVCOIN) security report
Radar AI scanned GavCoin's verified Ethereum source and reviewed GoPlus data. No minting, blacklist, tax manipulation, pause, or upgrade controls were found. The main concern is an immutable external distributor called during every transfer, plus reported concentration in a pool-manager contract.
The verified token contract does not expose minting, blacklist, adjustable taxes, pausing, upgradeability, or an obvious honeypot restriction. However, every non-mint transfer calls an immutable external distributor, so that dependency can create a material transfer-denial risk if it reverts or behaves maliciously. GoPlus also indicates concentrated token custody, which should be independently verified.
Trust score: 68/100. Source verified: Yes. Chain: ethereum. Contract: 0x27aa8dabfdacad9353744be79b1ff8526fb36c64.
This report was last modified on 2026-09-30 and contains 3 material findings.
medium finding: Immutable external distributor can block all token transfers
The token performs an external call to the configured distributor after every non-mint transfer. Because the distributor address is immutable and there is no fallback, disable switch, or recovery mechanism, a reverting, incompatible, or malicious distributor can cause transfers and transferFrom operations to revert globally.
Evidence: LaunchToken._update calls IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)) whenever from != address(0) and distributor != address(0). The call is not wrapped in try/catch. The distributor is assigned once in the constructor and cannot be changed. The interface is externally callable and its implementation was not supplied.
Recommendation: Review and verify the deployed distributor implementation and its authorization model. Test transfer behavior when the distributor reverts and consider a guarded callback, failure-tolerant accounting, or an emergency disable mechanism in future deployments.
medium finding: External transfer hook creates reentrancy and execution-coupling risk
The distributor callback is invoked after balances and total supply state are updated but before the transaction completes. A malicious or compromised distributor can reenter other token functions during transfers. The standard ERC20 state model limits direct unauthorized balance creation, but the callback expands the transfer attack surface and can interact with allowances or other integrated systems.
Evidence: LaunchToken._update calls an arbitrary external contract through IHolderDistributor.onTransfer after super._update. No reentrancy guard is present, and the distributor address is supplied by the deployment constructor. The supplied source does not include the distributor implementation.
Recommendation: Audit the deployed distributor and all contracts it can call. Apply reentrancy-safe design, tightly restrict distributor capabilities, and avoid relying on untrusted callbacks in core ERC20 transfer execution.
medium finding: Reported token custody is highly concentrated in a contract address
This may reflect pool-position custody rather than a conventional wallet balance, but the source and supplied evidence do not establish who controls the relevant position or whether the position can be withdrawn under independent safeguards. Concentrated custody creates material dependency on that contract and its associated pool configuration.
Evidence: GoPlus reports holder address 0x000000000004444c5dc75cb358380d2e3de08a90 with balance 954,937,399.463242179833694806 and percent 0.954937399463242179, tagged as a contract and identified as the Uniswap V4 pool manager.
Recommendation: Verify the underlying Uniswap V4 position, its owner or controlling hooks, withdrawal permissions, and any escrow or lock arrangements.