RuneXcape (RUNEXCAPE) security report
RuneXcape was AI scanned on Ethereum. The verified source shows fixed-supply ERC-20 behavior without exposed mint, blacklist, fee, or upgrade controls, but transfers depend on an external distributor callback that may revert.
The source does not expose post-deployment minting, blacklist controls, transfer taxes, upgradeability, or privileged withdrawal functions. However, every non-mint transfer depends on an external distributor contract, creating a conditional transfer-denial risk.
Trust score: 72/100. Source verified: Yes. Chain: ethereum. Contract: 0xccd2c5aaf345b51e584d71fcd760c14a1a38a2d2.
This report was last modified on 2026-10-08 and contains 1 material finding.
medium finding: External distributor callback can block token transfers
The token calls an external distributor contract after every non-mint transfer. If that distributor reverts, runs out of gas, or becomes unavailable, the entire token transfer transaction reverts because the callback is not wrapped in a failure-tolerant mechanism. This can affect transfers, approvals followed by transfers, and integrations that rely on normal ERC-20 movement.
Evidence: LaunchToken._update calls IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)) whenever from is not address(0) and distributor is not address(0). The distributor address is immutable and supplied to the constructor. The supplied interface confirms onTransfer is an external call with no documented non-reverting guarantee.
Recommendation: Use a trusted, audited distributor implementation and test its behavior under gas limits, reentrancy, and failure conditions. Consider removing the mandatory callback from the transfer path or isolating it so distributor failure cannot revert ERC-20 transfers.