Traivo (TRVO) security report
Radar AI scanned Traivo’s verified Ethereum contract. The main finding is a medium-severity risk: a reverting external distributor callback can block token transfers. No owner minting, blacklist, fee manipulation, or upgradeability was found in the supplied source.
Traivo uses a fixed-supply OpenZeppelin ERC-20 implementation, but transfers depend on an external distributor callback. If the configured distributor reverts or becomes unavailable, token transfers can fail. The distributor address is immutable, so this dependency cannot be changed after deployment.
Trust score: 76/100. Source verified: Yes. Chain: ethereum. Contract: 0x0d2f042a91d499dd9e77a735f1087a405806eaa9.
This report was last modified on 2026-10-07 and contains 1 material finding.
medium finding: External distributor callback can block all token transfers
The token performs an external call to the configured distributor during every non-mint transfer. Because a revert from this callback propagates through the token transfer, a broken, malicious, or unavailable distributor can create a transfer denial-of-service condition. The risk is conditional on the distributor reverting or otherwise becoming unusable.
Evidence: In LaunchToken._update, after super._update completes, the contract executes IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)) whenever from is nonzero and distributor is nonzero. The distributor is assigned in the constructor as an immutable address, and no recovery or replacement function exists.
Recommendation: Verify the deployed distributor implementation and its operational guarantees before relying on transfers. Consider redesigning the callback as non-blocking, adding a controlled emergency bypass, or using a distributor that cannot revert during normal token operations.