veil (veil) security report
Radar by SecureChain.ai AI-scanned the verified Veil contract on BSC. GoPlus reports no minting, blacklist, pause, or honeypot signal. The source review found material conditional risks: the owner holds about 72.15% of supply, controls migration states that restrict pool transfers, tax rates are not capped at 100%, and a reverting dividend callback can block transfers. Slither was not run, and live tax/state values were not supplied.
The supplied evidence does not prove an active honeypot or mint exploit. However, the verified source contains conditional paths that can restrict trading or freeze transfers, while the owner holds approximately 72.15% of supply and controls migration transitions. Independent source review was performed because Slither was skipped.
Trust score: 48/100. Source verified: Yes. Chain: bsc. Contract: 0x442c49383125a4dfd3b685819941e71b386c7777.
This report was last modified on 2026-09-20 and contains 4 material findings.
high finding: Tax parameters can be initialized above 100%, making pool transfers revert
The initializer accepts uint16 buy and sell tax rates without requiring either rate to be at most 10,000 basis points. If a rate exceeds 10,000, _taxedTransfer computes amount - tax and reverts. Once the relevant tax state is active, buys or sells involving a configured pool can therefore become unavailable.
Evidence: initialize() stores params.buyTax and params.sellTax directly in poolState. _getTaxWithPoolState calculates amount * taxRate / 10000, and _taxedTransfer executes uint256 remainingAmount = amount - tax. The maximum uint16 value permits rates up to 65535 basis points. Current on-chain buy and sell tax values were not supplied, so activation of this condition is unconfirmed.
Recommendation: Enforce buyTax and sellTax <= 10000 during initialization, expose and monitor the live state and rates, and require an independently reviewed deployment configuration before enabling pool trading.
high finding: Dividend callback failure can globally freeze token transfers
Every transfer involving a non-excluded account calls dividendContract.setShare() for the sender and/or recipient. Any revert from that external contract is caught and rethrown as DividendShareUpdateFailed, causing the token transfer itself to revert. A misconfigured, unavailable, or intentionally reverting dividend contract can therefore create a broad transfer lock.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare(from, balanceOf(from)) and setShare(to, balanceOf(to)) for non-excluded addresses; both catch blocks revert with DividendShareUpdateFailed. dividendContract is assigned during initialize() and there is no public recovery or replacement function in the verified contract. The supplied evidence does not include the dividend contract implementation or runtime behavior.
Recommendation: Use a fail-open or bounded-failure design for share accounting, add a governance-controlled emergency disable/replacement mechanism, validate the dividend contract during initialization, and test transfers when the external callback reverts or runs out of gas.
medium finding: Owner-controlled migration states can restrict launch and pool transfers
The owner alone controls startMigration() and finalizeMigration(). While the token remains in BondingCurve, transfers to or from every configured pool revert. The owner can delay these transitions, keeping a configured DEX pool unusable, and can determine when the tax-enforced launch state begins.
Evidence: startMigration() and finalizeMigration() are both onlyOwner. In _transfer(), PoolState.BondingCurve requires !pools[from] && !pools[to], reverting transfers involving configured pools. GoPlus identifies owner_address as 0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0, but no evidence shows that ownership was renounced or that the migration state is permanently controlled by governance.
Recommendation: Publish the intended state-transition schedule, use a timelocked or multisignature owner, verify the live pool state, and document conditions under which trading becomes enabled and taxes expire.
medium finding: High holder concentration creates material supply and liquidity risk
A single owner-associated address holds approximately 72.15% of total supply according to GoPlus. A large sale or transfer by that address could materially affect price, liquidity, and market stability. The concentration also gives the owner substantial economic influence even though the token has no public mint function.
Evidence: GoPlus reports total_supply=1000000000, owner_address=0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0, owner_balance=721472614.9039404, and owner_percent=0.721473. Project liquidity is reported as approximately $6,651.18, increasing the potential market impact of a large holder transaction.
Recommendation: Disclose allocation and vesting details, use transparent lockups or multisignature custody where appropriate, monitor large-holder movements, and assess whether current liquidity can absorb material sales.