Send it (SI) security report
Radar by SecureChain AI scanned the verified Send it SI contract on Base. The token uses fixed constructor-time supply and has no mint, blacklist, pause, fee, or upgrade controls. The review identified one medium-severity risk: token metadata is resolved through an externally changeable launcher base URI. Slither was not run.
No critical or high-severity asset-control vulnerability was identified in the verified token source. The token has fixed supply and unrestricted ERC-20 transfers. A medium-severity metadata integrity risk exists because tokenURI reads the launcher’s externally controlled baseTokenURI on every call.
Trust score: 92/100. Source verified: Yes. Chain: base. Contract: 0x0b123112f58bb11eb6c843e426d397d258f5e0e5.
This report was last modified on 2026-10-08 and contains 1 material finding.
medium finding: External launcher can change token metadata location
The tokenURI function calls launcher.baseTokenURI() on each read and concatenates the returned value with the token address. The launcher address is immutable, but the launcher’s base URI is external to this token and may be changed by launcher governance or administration. This can change the metadata endpoint presented by integrations without changing the token contract or balances.
Evidence: In src/StonkToken.sol, tokenURI() executes try IStonkLauncherBaseURI(launcher).baseTokenURI() and returns string.concat(base, _hexAddress(), ".json"). The source comment explicitly states that the platform domain can be rotated with a single owner call. The token exposes no immutable metadata URI of its own.
Recommendation: Document the launcher’s metadata authority and apply governance controls, monitoring, and change transparency to baseTokenURI updates. Integrations requiring stable metadata should pin or verify trusted content rather than relying solely on the live tokenURI response.