Jibe (JIBE) security report
Jibe was AI scanned from verified Solidity source with GoPlus evidence; Slither was not run. GoPlus reports no detected minting, blacklist, proxy, selfdestruct, or honeypot signal.
The contract was AI-scanned using the supplied verified source and GoPlus evidence.
Trust score: 48/100. Source verified: Yes. Chain: bsc. Contract: 0xd82c4054b32d75f8617af89c69b2e0971a257777.
This report was last modified on 2026-09-29 and contains 3 material findings.
high finding: Owner-controlled migration can block DEX trading
While the token remains in BondingCurve state, all transfers to or from configured pool addresses revert. Only the owner can call startMigration() and finalizeMigration(), so the owner can delay or prevent the state transition required for pool trading.
Evidence: _transfer() requires !pools[from] && !pools[to] in PoolState.BondingCurve. startMigration() and finalizeMigration() are both onlyOwner. The verified source does not provide a permissionless transition or timeout.
Recommendation: Use a permissionless or time-bounded migration mechanism, publish the intended migration schedule, and independently verify the current poolState and owner address on-chain.
medium finding: Dividend-contract failures can revert ordinary token transfers
If dividendContract is nonzero and its setShare() call fails, _afterTokenTransfer() reverts the entire token transfer. Because this hook runs for normal transfers involving eligible addresses, a broken, paused, malicious, or incompatible dividend contract can cause a broad transfer denial of service.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare() for from and to unless the address is excluded, a pool, the token contract, zero address, dead address, or dividend contract. Each failed call is caught and immediately reverted with DividendShareUpdateFailed.
Recommendation: Avoid making balance transfers depend on an external dividend contract, or provide a fail-open mode, bounded retry mechanism, emergency disable switch, and carefully validated dividend implementation.
medium finding: Initialization accepts tax rates above 100%
buyTax and sellTax are uint16 values but are not constrained to a maximum of 10000 basis points. If either configured rate exceeds 10000, taxed pool transfers calculate tax greater than amount and _taxedTransfer() reverts on amount - tax, potentially blocking buys or sells for the tax-enforced period.
Evidence: initialize() stores params.buyTax and params.sellTax directly in poolState. _getTaxWithPoolState() computes amount * rate / 10000, while _taxedTransfer() executes uint256 remainingAmount = amount - tax without checking tax <= amount. GoPlus did not supply current buy or sell tax values.
Recommendation: Require buyTax and sellTax <= 10000 during initialization and add tests covering boundary values.