Soon (SOON) security report
Soon (SOON) was AI scanned from verified source on BNB Chain. No Critical or High issue was confirmed, but the contract contains a conditional medium-risk transfer restriction that can blacklist contract bytecode configured at deployment. GoPlus did not flag it, and Slither was not run.
One conditional medium-severity transfer-restriction risk was identified. The contract can permanently block transfers involving selected contract bytecode patterns configured at deployment. GoPlus reports no blacklist, but the verified source independently shows this behavior. No Critical or High finding is confirmed from the supplied evidence.
Trust score: 25/100. Source verified: Yes. Chain: bsc. Contract: 0x6cb96d4955deb590e6c711b411795d58e2e37777.
This report was last modified on 2026-09-30 and contains 1 material finding.
medium finding: Constructor-configured bytecode blacklist can block transfers
The token maintains a mapping from arbitrary bytes values to booleans. On the first transfer, every entry in the constructor-provided `fee` array is marked as blocked. Every subsequent transfer reverts if either the recipient's runtime bytecode (`to.code`) or the caller's runtime bytecode (`msg.sender.code`) matches a blocked entry. This can prevent transfers to or from a configured DEX pair, router, vault, multisig, or other contract and cannot be changed after deployment because ownership is renounced and no management function exists for the mapping.
Evidence: In `_transfer(address from, address to, uint256 value)`, the first execution loops through `PoolwState` and executes `sign_[PoolwState[i]] = true`; it then executes `if (sign_[to.code] || sign_[msg.sender.code]) { revert(); }`. `PoolwState` is initialized from the constructor argument `fee` and has no public setter. The supplied GoPlus signal `is_blacklisted` is `0`, but GoPlus does not attest that this source-level bytecode comparison is absent.
Recommendation: Decode and publish the deployed constructor `fee` argument, compare each configured byte string with the runtime bytecode of all intended trading and custody contracts, and remove the code-based blacklist logic in a revised deployment. Before interacting, test transfers through the intended pair and router as well as ordinary wallet transfers.