PAYZ (PAYZ) security report
Radar by SecureChain AI scanned the verified PAYZ Ethereum contract. The source shows a fixed-supply ERC-20 without owner minting, fees, blacklist, or upgrade controls, but every non-mint transfer calls an immutable external distributor that can cause transfer failures.
The supplied source does not show owner-controlled minting, fee manipulation, blacklist logic, upgradeability, or a direct honeypot restriction. The principal material risk is the immutable distributor callback: if the configured distributor reverts or behaves maliciously, token transfers can fail or become unavailable.
Trust score: 68/100. Source verified: Yes. Chain: ethereum. Contract: 0x76c4a672f69566c0d9475a0aa6c570b6e9979ad0.
This report was last modified on 2026-10-07 and contains 1 material finding.
medium finding: Immutable external distributor can block token transfers
LaunchToken delegates control flow to an external distributor during every non-mint token movement. Because the distributor address is immutable and the callback is not wrapped in a try/catch, a distributor revert causes the entire transfer or transferFrom transaction to revert. A faulty or malicious distributor can therefore create a transfer-denial condition.
Evidence: LaunchToken._update first calls super._update(from, to, value), then executes `if (from != address(0) && distributor != address(0)) { IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)); }`. The distributor is assigned once from the constructor parameter `distributor_` and has no setter. The callback is an external call whose revert propagates to the token transaction.
Recommendation: Use a trusted, independently reviewed distributor implementation and verify its deployed address. Consider removing the mandatory callback, adding a fail-open design where appropriate, or providing a governed emergency mechanism to disable or replace a faulty distributor before deployment.