immortal fruit flies (IFF) security report
SecureChain AI scanned the verified IFF contract source and GoPlus evidence. Slither was not run. No explicit mint, blacklist, proxy, selfdestruct, or honeypot flag was reported, but the owner controls migration, pool transfers can remain restricted before migration, external dividend callbacks can make transfers revert, and GoPlus reports an unlocked owner-associated balance of about 35.45% of total supply.
The project was AI scanned using the verified source and GoPlus evidence; Slither was not run. Material risks include owner-controlled migration that can keep pool transfers restricted, a dividend callback that can block transfers if the external contract fails, and an unlocked owner-associated balance of approximately 35.45% of supply.
Trust score: 48/100. Source verified: Yes. Chain: bsc. Contract: 0x7c28942268bebd65012294b45266e5f7f5227777.
This report was last modified on 2026-09-19 and contains 3 material findings.
high finding: Owner can indefinitely control migration and keep pool trading restricted
The owner exclusively controls startMigration() and finalizeMigration(). While the token remains in BondingCurve state, every transfer involving a configured pool reverts. If the owner does not advance migration, activity through those pools can remain unavailable; if migration is advanced, timing and state transitions remain centrally controlled.
Evidence: In _transfer(), PoolState.BondingCurve requires !pools[from] && !pools[to], reverting with "Transfers to/from pools are restricted in BondingCurve state". Both startMigration() and finalizeMigration() are protected by onlyOwner. GoPlus reports owner address 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0 and owner balance of 354,514,479.4943 IFF, or 35.4514% of supply.
Recommendation: Use an immutable or time-bounded migration mechanism, publish the expected migration schedule, and restrict emergency intervention with a timelock or multisig. Verify on-chain that the token has reached the intended post-migration state before treating pool trading as operational.
medium finding: External dividend callback can block ordinary token transfers
Every transfer involving a non-exempt sender or recipient invokes dividendContract.setShare(). Any revert from that external contract is propagated as DividendShareUpdateFailed, causing the token transfer itself to revert. A malfunctioning, misconfigured, or deliberately reverting dividend contract could therefore deny transfers for affected accounts.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) inside try/catch blocks, then reverts on failure. Only the token contract, zero address, dead address, dividend contract, and configured pools are skipped. The dividendContract address is supplied during initialize() and cannot be changed afterward through the exposed contract functions.
Recommendation: Do not make balance transfers depend on a mandatory external callback. Consider non-blocking share updates, queued synchronization, a circuit breaker, or a trusted and independently audited dividend implementation with recovery procedures.
medium finding: Large unlocked owner-associated token concentration creates material sell-pressure risk
GoPlus identifies the owner as a contract address holding approximately 35.45% of the total supply, and reports the balance as unlocked. A sale or transfer by the controlling owner or its associated contract could materially affect market price and liquidity. This is a concentration and governance risk rather than proof of malicious conduct.
Evidence: GoPlus evidence reports owner_address 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0, owner_balance 354514479.49429977, owner_percent 0.354514, and is_locked 0. Reported liquidity is approximately $19,814.77, increasing the potential market impact of a large sale.
Recommendation: Disclose the owner and contract control structure, lock or vest concentrated allocations where appropriate, and publish treasury and selling policies. Monitor holder concentration and liquidity before assuming the market can absorb a large transfer.