Truman World (TRUMAN) security report
Radar by SecureChain.ai AI-scanned Truman World (TRUMAN) on BSC using verified source and GoPlus evidence. No Critical or High issue was proven. Medium risks involve external dividend callbacks that can revert transfers, unlimited tax-processor allowance and fallback custody of accrued tax tokens, and initializer tax rates that can exceed 100%. GoPlus reports no minting, blacklist, proxy, or honeypot signal. Slither was not run.
No Critical or High vulnerability was proven from the supplied source and evidence. Three Medium risks were identified: transfer availability depends on an external dividend contract, tax processing grants an effectively unlimited token allowance to an external processor, and initialization permits buy or sell taxes above 100% if misconfigured. GoPlus reports no honeypot, no minting, no blacklist, no proxy, and locked LP evidence.
Trust score: 72/100. Source verified: Yes. Chain: bsc. Contract: 0xabffa443547b34ab6c3b3173d26e233900527777.
This report was last modified on 2026-09-20 and contains 3 material findings.
medium finding: External dividend callback can block ordinary token transfers
When dividendContract is nonzero, every transfer involving a non-pool, non-contract, non-zero, and non-dead address calls IDividend.setShare(). Any revert from that external call is propagated as DividendShareUpdateFailed, causing the entire token transfer to revert. This can materially restrict transfers if the configured dividend contract is unavailable, misconfigured, or intentionally rejects updates.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare() for sender and recipient and reverts in both catch blocks. initialize() accepts an arbitrary dividendContract address. The supplied ABI and GoPlus data do not establish that the configured dividend contract is reliable or currently operational.
Recommendation: Use a non-blocking dividend update pattern, such as recording failed updates for later processing, or add a carefully governed emergency bypass. Verify the deployed dividendContract implementation, access control, and liveness.
medium finding: External tax processor receives unlimited allowance and controls tax handling
During tax liquidation, the token approves taxProcessor for type(uint256).max and calls its processTaxTokens() function. If processing fails, the catch path transfers the entire token balance held by the token contract to taxProcessor. A compromised, malicious, or incorrectly configured processor can therefore control or drain accrued tax tokens held by the token contract, subject to the processor configuration established at initialization.
Evidence: _processTax() sets _approve(address(this), taxProcessor, type(uint256).max) and invokes ITaxProcessor(taxProcessor).processTaxTokens(taxAmount). On failure, it calls _plainTransfer(address(this), taxProcessor, remainingBalance). initialize() accepts taxProcessor as an external address and there is no later setter or validation of its implementation in the supplied contract.
Recommendation: Use exact, per-liquidation approvals and revoke or reduce allowances after processing. Validate the processor address against an immutable or governed allowlist, restrict fallback transfers to the intended taxAmount, and provide monitoring for processor changes or abnormal balances.
medium finding: Initialization permits potentially disabling buy or sell taxes
The initializer accepts uint16 buyTax and sellTax values without enforcing a maximum of 10000 basis points. If either configured rate exceeds 100%, _taxedTransfer() computes amount - tax and reverts due to underflow, preventing the affected buy or sell path while the corresponding tax state is active. The supplied GoPlus buy_tax and sell_tax fields are blank, so the deployed rates were not independently confirmed.
Evidence: initialize() directly stores params.buyTax and params.sellTax in poolState. _getTaxWithPoolState() calculates amount * rate / 10000, while _taxedTransfer() executes uint256 remainingAmount = amount - tax. uint16 permits values up to 65535 basis points. GoPlus supplied empty buy_tax and sell_tax values.
Recommendation: Enforce buyTax <= 10000 and sellTax <= 10000 during initialization, ideally with a lower documented maximum. Confirm the live poolState rates and test both buy and sell simulations across all configured pools.