MEME NASDAQ (MDAQ) security report
SecureChain AI scanned the verified MEME NASDAQ source and GoPlus evidence. Slither was skipped. No visible mint, blacklist, proxy, or selfdestruct path was identified, but material risks include an unlimited tax-processor allowance, dividend callback transfer blocking, owner-controlled migration restrictions, approximately 44.81% owner supply concentration, and inconsistent liquidity reporting.
The reviewed source does not show an immediately exploitable mint or blacklist backdoor, and GoPlus reports no honeypot, minting, blacklist, proxy, or transfer-pause signals. However, the contract is not low-risk: the configured tax processor receives an unlimited token allowance, dividend callbacks can block transfers, the owner controls migration state, and the owner wallet holds approximately 44.81% of supply. Slither was skipped, so this is not a completed static-analysis report.
Trust score: 48/100. Source verified: Yes. Chain: bsc. Contract: 0x63082387b0753f8c45adc4af5d3469fd711d7777.
This report was last modified on 2026-09-19 and contains 6 material findings.
high finding: Configured tax processor receives unlimited allowance over tax reserves
The token grants the configured taxProcessor an unlimited allowance from the token contract. A compromised, malicious, or incorrectly configured tax processor can use transferFrom to move the token contract's accumulated tax balance beyond the amount intended for a single liquidation.
Evidence: In _processTax(), the contract executes _approve(address(this), taxProcessor, type(uint256).max) whenever the allowance is below taxAmount, then calls the external ITaxProcessor(taxProcessor).processTaxTokens(taxAmount). The taxProcessor is fixed during initialize() and there is no owner-controlled setter or allowance revocation path.
Recommendation: Use an exact allowance for each liquidation, reset it after processing, and verify that the processor pulls no more than taxAmount. Consider immutable or audited processor code, explicit authorization checks, and a recovery mechanism for stuck tax balances.
medium finding: Dividend callback failure can block token transfers
When dividendContract is configured, ordinary transfers call setShare() for eligible sender and recipient addresses. Any revert from the external dividend contract causes the entire token transfer to revert, creating a transfer denial-of-service condition if that dependency is paused, misconfigured, or otherwise unavailable.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) inside try/catch blocks, but catches revert with DividendShareUpdateFailed, which reverts the parent transfer. The hook is reached from transfer(), transferFrom(), and taxed transfers.
Recommendation: Do not make core token transfers depend on a successful dividend callback. Use a non-blocking update pattern, queue failed share updates, or provide a bounded recovery/disable mechanism controlled by a secured governance process.
medium finding: Owner-controlled migration state can restrict pool transfers
The owner controls startMigration() and finalizeMigration(). While the token remains in BondingCurve state, all transfers to or from any configured pool revert. A delayed or deliberately withheld migration can therefore prevent normal DEX trading through configured pools.
Evidence: startMigration() is onlyOwner and finalizeMigration() is onlyOwner. In _transfer(), PoolState.BondingCurve requires !pools[from] && !pools[to], reverting with "Transfers to/from pools are restricted in BondingCurve state". GoPlus reports transfer_pausable=0, but the source still contains this state-dependent pool restriction.
Recommendation: Use an immutable or time-bound migration schedule, multisig or governance control, and publish the current state and migration authority. Confirm on-chain that the token has reached the intended trading state.
medium finding: Owner wallet concentration creates material sell-pressure risk
A single owner address holds a large portion of the fixed supply. A sale or transfer by that wallet could materially affect market price and liquidity, independent of code-level protections.
Evidence: GoPlus reports owner_address 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0 with owner_balance 448084570.9213375 and owner_percent 0.448085, approximately 44.81% of the reported 1 billion token supply. The contract mints the full maxSupply to msg.sender during initialize().
Recommendation: Verify vesting, lockups, multisig custody, and disclosed allocation terms. Monitor large transfers from the owner address and assess effective circulating supply rather than relying only on total supply.
medium finding: Tax-rate configuration can lock pool trading if initialized above 100%
The source accepts uint16 buy and sell tax rates without requiring them to be at or below 10,000 basis points. If either configured rate exceeds 100%, the calculated tax exceeds the transfer amount and amount - tax reverts, blocking the affected pool direction while tax enforcement is active.
Evidence: initialize() stores params.buyTax and params.sellTax directly into poolState without an upper-bound check. _getTaxWithPoolState() calculates amount * rate / 10000, and _taxedTransfer() executes uint256 remainingAmount = amount - tax. The deployed initialization parameters were not supplied, so the live impact cannot be confirmed from the evidence provided.
Recommendation: Enforce buyTax and sellTax <= 10000 during initialization and add tests for boundary values. Verify the deployed buyTaxRate(), sellTaxRate(), and pool state before trading.
medium finding: Liquidity data is inconsistent and indicates elevated exit risk
The supplied market data does not consistently establish meaningful liquidity. Low or misreported liquidity can cause severe slippage and make exiting positions difficult even when token transfer logic operates normally.
Evidence: Project data lists liquidityUsd as 21375.35, while GoPlus reports the PancakeV2 pair with liquidity "0.00000000" and liquidity_type UniV2. GoPlus also reports holder_count="0". These values may reflect indexing or timing issues, but they require verification before relying on the market.
Recommendation: Verify the pair reserves, LP-token ownership or lock status, active trading volume, and current holder distribution directly on BSC. Treat the GoPlus/project-data discrepancy as unresolved until reconciled.