Vibe Trader (VIBE) security report
Radar by SecureChain AI scanned Vibe Trader on Ethereum. The token has a fixed-supply ERC-20 design, but every non-mint transfer calls an immutable external distributor that could create a transfer-denial risk.
The token follows a largely standard ERC-20 transfer model, but transfers can be blocked if the constructor-selected distributor reverts, consumes excessive gas, or becomes unavailable. The distributor implementation was not supplied, so its behavior and trust assumptions require separate review. Slither was skipped.
Trust score: 78/100. Source verified: Yes. Chain: ethereum. Contract: 0xc6a5fe87284a4881fee17b091f39561fd48016c8.
This report was last modified on 2026-10-07 and contains 1 material finding.
medium finding: Immutable external distributor can block all token transfers
Every transfer, including transferFrom operations, makes an external call to the immutable distributor address after balances are updated. If that distributor reverts, runs out of gas, or is otherwise unavailable, the entire token transfer transaction reverts. Because the address is immutable and there is no fallback or replacement mechanism, the token cannot disable or change this dependency after deployment.
Evidence: In LaunchToken._update, after super._update(from, to, value), the condition `from != address(0) && distributor != address(0)` calls `IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to))`. The distributor is assigned once in the constructor and declared `immutable`; the supplied interface does not establish that onTransfer is non-reverting or bounded in gas.
Recommendation: Review and independently audit the deployed distributor implementation, including its authorization, gas usage, reentrancy behavior, and failure handling. Prefer a non-blocking hook pattern, a trusted minimal distributor, or an emergency-controlled way to disable or replace the callback before deployment where governance requirements permit.