Send (SEND) security report
SecureChain AI scanned the verified Send (SEND) BSC contract and reviewed GoPlus evidence. No Critical exploit was established. Slither was not run, and the report is not a guarantee of safety.
The contract was AI scanned from verified source and cross-checked against GoPlus. Slither was not run.
Trust score: 58/100. Source verified: Yes. Chain: bsc. Contract: 0x56499f0287e1547694c665b07fd8dafe743e7777.
This report was last modified on 2026-09-29 and contains 3 material findings.
medium finding: Owner can control migration state and restrict pool transfers
The owner can start migration at any time and controls finalization. While the token remains in BondingCurve state, every transfer involving a configured pool reverts. If migration is delayed, incorrectly sequenced, or the owner becomes unavailable, trading through the configured pools can remain restricted.
Evidence: Source: startMigration() and finalizeMigration() are onlyOwner. In _transfer(), BondingCurve state requires !pools[from] && !pools[to], reverting with "Transfers to/from pools are restricted in BondingCurve state".
Recommendation: Expose and monitor current state, document the migration authority, use a multisig or timelocked owner, and add an independently verifiable launch-state procedure with a recovery path if migration is interrupted.
medium finding: External dividend callback can halt ordinary token transfers
When dividendContract is nonzero, every transfer involving a non-excluded sender or recipient synchronously calls dividendContract.setShare(). Any revert from that external contract causes the token transfer to revert through DividendShareUpdateFailed. A broken, incompatible, paused, or maliciously configured dividend contract could therefore block transfers for affected accounts.
Evidence: Source: _afterTokenTransfer() calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)); both failures are caught and rethrown. initialize() accepts dividendContract without checking code, interface behavior, or an emergency bypass. Pools, the token contract, zero address, dead address, and dividendContract itself are excluded, but ordinary users are not.
Recommendation: Avoid making core transfers depend on a reverting external callback. Use non-blocking share updates, a controlled retry queue, an emergency disable switch governed by a multisig, and strict validation of the dividend contract during initialization.
medium finding: Initializer accepts tax rates above 100%, which can make pool trading revert
The buy and sell tax parameters are uint16 values but are not capped at 10000 basis points. If either configured rate exceeds 10000, tax can equal or exceed the transfer amount; _taxedTransfer then computes amount - tax and reverts on underflow, blocking the corresponding taxed pool direction.
Evidence: Source: initialize() stores params.buyTax and params.sellTax directly in poolState without requiring a rate <= 10000. _getTaxWithPoolState() calculates amount * rate / 10000, and _taxedTransfer() performs uint256 remainingAmount = amount - tax. The supplied ABI does not expose the initialized values, so the deployed configuration could not be confirmed from the evidence provided.
Recommendation: Enforce buyTax and sellTax <= 10000 during initialization, preferably with a lower documented protocol maximum. Verify the deployed values on-chain before enabling trading.