Payooor (PAYOOOR) security report
Radar by SecureChain AI scanned Payooor on Ethereum. The verified source shows a medium-severity transfer-availability risk from an external distributor callback that can revert transfers.
The token does not expose obvious privileged minting, upgradeability, blacklist, or fee-manipulation controls. However, transfers depend on an externally supplied distributor contract. If that contract reverts, consumes excessive gas, or behaves incompatibly, ordinary token transfers can fail.
Trust score: 72/100. Source verified: Yes. Chain: ethereum. Contract: 0xd493a2315ca1365f971647e6dd6668f3f0c12cd9.
This report was last modified on 2026-10-10 and contains 1 material finding.
medium finding: External distributor callback can block token transfers
Every non-mint token transfer performs an external call to the immutable distributor address after balances are updated. A distributor contract that reverts, becomes incompatible, or deliberately rejects calls can cause the entire token transfer transaction to revert, creating a transfer-availability and dependency risk.
Evidence: LaunchToken._update calls super._update(from, to, value), then, when from is not the zero address and distributor is not the zero address, executes IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)). The callback has no try/catch or failure isolation, so a revert propagates to transfer and transferFrom. The distributor address is assigned from the constructor argument and declared immutable. GoPlus reports transfer_pausable as 0, but that signal does not remove this source-level external callback dependency.
Recommendation: Verify the deployed distributor address and its onTransfer implementation, including its revert conditions and upgrade or administrative controls. Consider isolating accounting hooks from token-transfer success, adding failure handling, or deploying a distributor whose availability and behavior are independently controlled and reviewed.