奶蛙 (奶蛙) security report
Radar AI scanned the verified 奶蛙 contract on BNB Smart Chain. Findings include a dividend-contract transfer dependency, tax-processor fallback routing, and initialization configuration risk.
The contract does not show an obvious unrestricted mint, blacklist, pause, or explicit honeypot path in the supplied source. However, transfers can be globally disrupted if the configured dividend contract fails, and tax handling depends on an external processor that can receive all accumulated tax tokens when processing fails.
Trust score: 72/100. Source verified: Yes. Chain: bsc. Contract: 0xf98f6b1204cc742b259100395ebd30bfbeac7777.
This report was last modified on 2026-11-04 and contains 3 material findings.
medium finding: External dividend contract can block token transfers
The token makes mandatory external calls to the configured dividend contract after ordinary transfers. If either setShare call reverts, the token deliberately reverts the entire transfer through DividendShareUpdateFailed. Because dividendContract is assigned during initialization and there is no setter or recovery path in this contract, a malfunctioning, incompatible, or unavailable dividend contract can prevent transfers involving ordinary addresses.
Evidence: In _afterTokenTransfer, when dividendContract is nonzero, the contract calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) for non-excluded addresses. Each call is wrapped in try/catch, but the catch executes revert DividendShareUpdateFailed(...). The GoPlus evidence does not report transfer pausable behavior, so this risk is source-derived rather than an observed pause.
Recommendation: Use a non-blocking dividend update design, such as recording failed updates for later retry instead of reverting transfers. Validate the dividend contract during initialization and provide a controlled recovery or replacement mechanism subject to transparent governance.
medium finding: Tax-processing failure forwards the full accumulated tax balance to the tax processor
If the external tax processor rejects or fails during liquidation, the token does not retain the tax balance or retry safely. Instead, it transfers the remaining token balance held by the token contract directly to taxProcessor. This creates a strong dependency on the configured processor and can cause accounting or fund-routing loss if that processor is misconfigured, compromised, or behaves unexpectedly.
Evidence: In _processTax, a failed ITaxProcessor(taxProcessor).processTaxTokens(taxAmount) call enters the catch block, reads balanceOf(address(this)), and calls _plainTransfer(address(this), taxProcessor, remainingBalance). taxProcessor is assigned in initialize and is not changeable through any function in the supplied token contract.
Recommendation: Use an explicit escrow and retry mechanism, limit fallback transfers to the tax amount being processed, and verify processor configuration and accounting before deployment. Consider pausing only tax liquidation while preserving ordinary transfers when processing fails.
medium finding: Initialization parameters control supply recipient, pool restrictions, and tax behavior
The initializer accepts deployment-critical configuration from its caller. It mints the entire maximum supply to msg.sender, sets the caller-selected pools, tax processor, dividend contract, tax rates, and migration durations, and starts the token in BondingCurve state. An incorrectly initialized clone, or a deployment process that exposes initialization before the intended call, can result in incorrect ownership, supply allocation, transfer restrictions, or fee behavior.
Evidence: initialize is external and protected only by the one-time initializer modifier. It calls _mint(msg.sender, maxSupply), sets taxProcessor, dividendContract, pools, buyTax, sellTax, taxDuration, and antiFarmerDuration, and sets poolState.state to BondingCurve. The implementation constructor disables initialization on the implementation itself, but clone or proxy deployment safety depends on atomic initialization. GoPlus reports is_proxy as 0 and owner_address as the zero address, but that does not independently attest to the initialization procedure used by any factory.
Recommendation: Initialize clones atomically during deployment, verify all initialization arguments on-chain, reject zero or invalid pool and dependency addresses, and test configured tax rates and migration states before distributing tokens.