Optimus Prime (PRIME) security report
Radar AI scanned Optimus Prime PRIME on Ethereum. The source shows a fixed-supply ERC-20 with no visible owner mint, blacklist, tax, or upgrade controls, but transfers call an immutable external distributor that can revert and block transfers.
The token has a standard fixed-supply ERC-20 transfer path, but every non-mint transfer calls the constructor-configured distributor contract. If that external call reverts or consumes excessive gas, transfers can fail. No direct owner mint, blacklist, fee-control, or upgrade mechanism is present in the supplied source.
Trust score: 72/100. Source verified: Yes. Chain: ethereum. Contract: 0x922d0ac4404cf457776345bc44b4260e4cca995e.
This report was last modified on 2026-10-17 and contains 1 material finding.
medium finding: External distributor callback can block token transfers
Every non-mint transfer invokes an external contract selected at deployment. If the distributor reverts, runs out of gas, or contains restrictive logic, the entire token transfer transaction reverts because the callback is part of the transfer execution path.
Evidence: LaunchToken._update first calls super._update(from, to, value), then executes IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)) whenever from is not the zero address and distributor is not address(0). The distributor address is immutable and supplied to the constructor.
Recommendation: Use a trusted, audited distributor implementation and ensure transfer accounting cannot be made dependent on a failure-prone external call. Consider isolating distributor accounting from transfers, adding a failure-tolerant mechanism, or providing a controlled way to disable or replace a faulty hook before deployment.