Sparky (SPARKY) security report
Radar AI scanned Sparky's verified Base token source. The ERC-20 has fixed supply and no visible owner, blacklist, pause, tax, upgrade, or post-deployment mint controls. One medium-severity risk was identified: the deploying factory receives the entire initial supply, while the token does not enforce the documented pool or locker deposit. Slither was not run.
No critical or high-severity exploit is evident in the verified LaunchToken source. One medium-severity business-logic and custody risk remains: the full initial supply is entrusted to the factory at deployment, and the token contract cannot ensure that the factory deposits or distributes it as documented.
Trust score: 82/100. Source verified: Yes. Chain: base. Contract: 0x4d54fec8628bbf7de3e73d180a1c21923b591290.
This report was last modified on 2026-10-05 and contains 1 material finding.
medium finding: Entire initial supply is entrusted to the deploying factory
The constructor mints the complete constructor-supplied amount to msg.sender, recorded as the immutable factory address. The token contract contains no logic requiring that factory to deposit the tokens into a pool or locker, so the launch process depends on correct behavior by an external factory contract.
Evidence: LaunchToken.constructor sets factory = msg.sender and executes _mint(msg.sender, supply). The contract documentation says the factory immediately deposits the full supply into a Uniswap v4 position, but no such deposit or verification exists in LaunchToken. The ABI exposes factory as an informational immutable address and provides no recovery or enforcement mechanism.
Recommendation: Review and verify the factory's launch() implementation, including the exact recipient of the minted supply and the atomicity of pool or locker initialization. If the intended invariant is critical, enforce the deposit in the factory transaction or use a design that prevents the factory from retaining or misrouting the initial supply.