Just a DEV (DEV) security report
Radar AI scanned Just a DEV on BNB Smart Chain. The verified source has no public mint or blacklist path, but external dividend callbacks can revert transfers and invalid tax configuration can block taxed trades.
The verified source does not expose an obvious public mint, blacklist, proxy-upgrade, or owner-controlled fee setter. However, the configured dividend contract can revert transfers, and buy or sell tax values above 10000 basis points can make taxed transfers revert through arithmetic underflow. Both issues require configuration or integration conditions but are material risks.
Trust score: 62/100. Source verified: Yes. Chain: bsc. Contract: 0x01d3ee54524334716b1f39dcd1e6041783e27777.
This report was last modified on 2026-10-12 and contains 4 material findings.
medium finding: External dividend callback can block token transfers
Every transfer involving a non-excluded account invokes dividendContract.setShare for the sender and/or recipient. Any revert from that external call is propagated through DividendShareUpdateFailed, reverting the entire token transfer.
Evidence: In _afterTokenTransfer, IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) are called inside try blocks whose catch clauses execute revert DividendShareUpdateFailed(...). dividendContract is supplied during initialize and has no setter or fallback handling in the token.
Recommendation: Use a non-reverting dividend integration, isolate accounting failures from ERC-20 transfers, or add a controlled recovery mechanism that can disable the callback after a verified failure. Validate the dividend contract before initialization.
medium finding: Initialization permits tax rates that can make pool transfers revert
The initializer accepts uint16 buyTax and sellTax values without requiring them to be at most 10000 basis points. When a configured tax exceeds 100 percent, _taxedTransfer computes amount - tax and reverts, blocking the affected taxed buy or sell path.
Evidence: initialize stores params.buyTax and params.sellTax directly in poolState. _getTaxWithPoolState calculates (amount * currentBuyTaxRate) / 10000 or (amount * currentSellTaxRate) / 10000, while _taxedTransfer executes uint256 remainingAmount = amount - tax. No upper-bound validation is present.
Recommendation: Require both tax parameters to be <= 10000 during initialization and add deployment-time assertions for the stored values. Test all migration and tax-enforcement states with boundary inputs.
medium finding: Tax processing relies on a privileged external processor and failure redirects accumulated tax
The token approves the configured taxProcessor for an effectively unlimited allowance and calls it during liquidation. If processTaxTokens reverts, the catch path transfers the entire token tax balance to taxProcessor instead of retaining it for a later retry. A misconfigured or compromised processor can therefore disrupt tax accounting and receive accrued tax tokens.
Evidence: _processTax sets allowance(address(this), taxProcessor) to type(uint256).max when needed. On any caught failure from ITaxProcessor(taxProcessor).processTaxTokens(taxAmount), the contract reads balanceOf(address(this)) and calls _plainTransfer(address(this), taxProcessor, remainingBalance). taxProcessor is fixed during initialize.
Recommendation: Restrict processor configuration to a verified implementation, avoid unlimited approvals where practical, preserve failed balances for retry, and emit explicit recovery/accounting events. Monitor processor code and permissions independently.
medium finding: Owner controls the transition from pool-restricted bonding state to migration and tax enforcement
The owner alone can call startMigration and finalizeMigration, controlling when the token leaves BondingCurve restrictions and when tax enforcement begins. A stalled or incorrect administrative transition can delay pool interaction or expose transfers under an unintended state.
Evidence: startMigration and finalizeMigration are both external onlyOwner functions. In BondingCurve, _transfer requires !pools[from] && !pools[to], while finalizeMigration changes the state to TaxEnforcedAntiFarmer and initializes tax expiration timestamps.
Recommendation: Document the state machine, use a timelocked or multisignature owner, publish expected transition parameters, and add operational monitoring for prolonged or unexpected states.