Jeffree (DOOGLER) security report
SecureChain AI reviewed the verified Jeffree (DOOGLER) source and supplied GoPlus evidence. No Critical or High vulnerabilities were found in the token contract. The fixed-supply ERC-20 has no minting, blacklist, pause, fee, proxy, or transfer-restriction logic. Medium risks are concentrated initial supply custody by the launcher and externally controlled token metadata. Slither was not run, and liquidity and launcher behavior require separate verification.
No Critical or High vulnerability was identified in the supplied token source. The main material risk is that 100% of the supply is minted to the immutable launcher address, while the token contract itself does not enforce liquidity placement, locking, or distribution. GoPlus reports no minting, blacklist, proxy, honeypot, tax, or owner-balance signals, but also reports is_in_dex=0 and holder_count=0.
Trust score: 82/100. Source verified: Yes. Chain: base. Contract: 0xff70b676aa2f96e293f020539b36d817179dbaa3.
This report was last modified on 2026-09-19 and contains 2 material findings.
medium finding: Entire initial supply is concentrated in the launcher
The constructor mints the full token supply directly to launcher_ and provides no on-chain requirement that the launcher add liquidity, lock liquidity, distribute tokens, or follow any particular allocation. The token contract cannot prevent the launcher from transferring or selling the full supply. This creates a material launch and concentration risk, even though the launcher address is immutable and has no special post-deployment token permissions.
Evidence: StonkToken constructor executes _mint(launcher_, totalSupply_). The source comments state that the launcher is expected to place the supply into a Uniswap V3 position, but that behavior is not enforced by this contract. Supplied GoPlus evidence reports is_in_dex=0 and holder_count=0; the supplied project data separately reports approximately $34,584.81 liquidity.
Recommendation: Verify the launcher transaction history, the actual liquidity position, its lock or custody arrangements, and the distribution of tokens before relying on the stated launch flow. A future deployment should use a verifiable launcher that atomically creates liquidity and applies an enforceable lock or distribution policy.
medium finding: Token metadata is controlled by an external live URI provider
tokenURI() queries launcher.baseTokenURI() on every call and concatenates the returned value with the token address. The token contract does not store an immutable metadata base, validate the returned domain, or prevent the launcher from changing the response. A launcher-side change or failure can alter, replace, or blank the token metadata used by wallets and explorers.
Evidence: tokenURI() calls IStonkLauncherBaseURI(launcher).baseTokenURI() and returns string.concat(base, _hexAddress(), ".json"); failures return an empty string. The source comments explicitly state that the platform domain can be rotated with a single owner call, although the launcher implementation was not supplied for independent verification.
Recommendation: Review and monitor the launcher’s baseTokenURI administration and hosting controls. For stronger metadata integrity, use content-addressed immutable metadata or a governance-controlled update process with transparent events and documented recovery behavior.