Printher (PRINT) security report
Radar by SecureChain AI scanned Printher PRINT on Ethereum. The fixed-supply ERC-20 has no exposed admin mint or fee controls, but its immutable distributor callback can cause transfer failures if the external hook reverts.
The verified token source does not expose administrative minting, fee manipulation, blacklist controls, upgradeability, or honeypot-specific transfer rules. However, when configured with a nonzero distributor, every non-mint transfer makes an external call to that distributor; if it reverts or becomes unavailable, token transfers can be blocked.
Trust score: 68/100. Source verified: Yes. Chain: ethereum. Contract: 0xfa64edcb785f1e0ae237ad686245cba419ffb10b.
This report was last modified on 2026-10-08 and contains 1 material finding.
medium finding: Immutable external distributor can block all non-mint transfers
The token delegates an external callback to the configured distributor during every non-mint transfer. Because the callback is not wrapped in error handling, any revert from the distributor causes the entire token transfer to revert. The distributor address is immutable, so this dependency cannot be replaced through the token contract.
Evidence: In LaunchToken._update, after super._update(from, to, value), the code checks `from != address(0) && distributor != address(0)` and then directly calls `IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to));`. Solidity external-call failures propagate unless caught. The constructor permanently assigns `distributor = distributor_`.
Recommendation: Before deployment, verify that the configured distributor is trusted, correctly implemented, and resilient to arbitrary transfer callers. Consider making the hook optional or fail-open, adding an authorized update mechanism with safeguards, or isolating distributor accounting so a callback failure cannot block ERC-20 transfers.