TipDrop (TDP) security report
Radar AI scanned TipDrop's verified ERC-20 source on BNB Smart Chain. No critical or high findings were identified. One medium business-logic risk concerns minting the entire initial supply to a single constructor recipient without vesting or distribution controls.
No Critical or High findings were identified. One Medium-severity business-logic risk was identified: the constructor mints the entire fixed supply to a single recipient address selected at deployment, with no vesting, allocation limits, or contract-enforced distribution safeguards.
Trust score: 93/100. Source verified: Yes. Chain: bsc. Contract: 0xf46c57c84326240825dbd8cb010dc22e4e2ae97b.
This report was last modified on 2026-10-14 and contains 1 material finding.
medium finding: Entire initial supply is assigned to one constructor recipient
The deployment constructor accepts an arbitrary recipient address and mints the complete initial supply to that address in one transaction. The token has no vesting, timelock, allocation cap per recipient, or distribution mechanism enforced by the contract. Control of that recipient's tokens can therefore materially affect supply availability and token economics.
Evidence: In TipDrop's constructor, `constructor(address recipient) ERC20("TipDrop", "TDP") { _mint(recipient, 1000000000 * 10 ** decimals()); }`. No other TipDrop function distributes, locks, or restricts this allocation. The supplied GoPlus evidence reports `is_mintable: 0`, consistent with there being no later public mint path, but it does not mitigate the constructor-time concentration design.
Recommendation: Document the intended initial allocation and recipient control model. If distribution risk is material, mint to a vesting or timelock contract, split allocations among explicitly defined recipients, or implement audited vesting and release controls before deployment. Verify the constructor recipient and deployment process independently.