Quantum Day (QDAY) security report
Radar AI scanned Quantum Day (QDAY) on Ethereum. The verified source uses standard ERC-20 logic but calls an immutable distributor during every non-mint transfer, creating a medium-severity transfer-availability risk.
The main material risk is the immutable external distributor callback executed during every non-mint transfer. The token otherwise uses standard OpenZeppelin ERC-20 transfer and allowance logic, with supply minted once in the constructor and no apparent administrative transfer restrictions or post-deployment mint authority.
Trust score: 72/100. Source verified: Yes. Chain: ethereum. Contract: 0x7b5eac4de80b33a4b5962684738398b3e3cda241.
This report was last modified on 2026-10-13 and contains 1 material finding.
medium finding: Immutable distributor callback can block all token transfers
Every non-mint transfer makes an external call to the immutable distributor contract after balances are updated. If the distributor reverts, runs out of gas, or contains incompatible logic, the originating token transfer also reverts. Because the distributor cannot be changed after deployment, this creates a persistent transfer-availability dependency.
Evidence: LaunchToken._update overrides ERC20._update and executes `if (from != address(0) && distributor != address(0)) { IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)); }`. The constructor permanently assigns `distributor = distributor_`, and the interface call is not wrapped in a try/catch. This path is reached by transfer and transferFrom for every non-mint movement.
Recommendation: Verify the deployed distributor bytecode and behavior, including whether onTransfer can revert or consume excessive gas. Consider a fail-open design, a bounded and audited callback, an emergency bypass, or a thoroughly reviewed distributor implementation before relying on the token for transfers.