Radar by SecureChain AI

NationalMedalofScience (NMS) security report

Radar by SecureChain AI scanned NationalMedalofScience (NMS) on Base. The verified token source shows fixed supply and no mint, blacklist, pause, tax, or proxy controls. A medium-severity risk affects metadata because tokenURI() relies on an external launcher that can change or disable the metadata base URI.

No direct token-transfer theft, minting, blacklist, honeypot, or transfer-lock mechanism was identified in the verified token source. A medium-severity metadata integrity risk exists because tokenURI() depends on the external launcher’s mutable baseTokenURI().

Trust score: 85/100. Source verified: Yes. Chain: base. Contract: 0x62e1eb126017b1383ae3bbc374b43d9b1d25b7d9.

This report was last modified on 2026-10-08 and contains 1 material finding.

medium finding: External launcher can alter or disable token metadata

The token does not store an immutable metadata URI. Each tokenURI() call queries launcher.baseTokenURI(), concatenates the returned base with the token address, and returns an empty string when the launcher call fails or the base is empty. The verified source documentation states that the platform domain can be rotated through a launcher owner call. This permits metadata to change or disappear without changing the token contract or its balances.

Evidence: In src/StonkToken.sol, tokenURI() executes try IStonkLauncherBaseURI(launcher).baseTokenURI(), returns "" when bytes(base).length == 0, and catches all failures by returning "". The launcher address is immutable, but the external baseTokenURI() implementation and its administrative controls are not included in the supplied token source. The GoPlus signal is_open_source=1; no Slither findings are available because Slither was not run.

Recommendation: Review and verify the deployed launcher implementation and its baseTokenURI administration. If metadata immutability is required, use an immutable content-addressed URI or add a governance-controlled, timelocked, and transparently documented metadata update process with an emergency fallback.