wildebeest (wildebeest) security report
Wildebeest was AI scanned from verified source with GoPlus evidence. The tax wallet can withdraw contract-held assets, and permanent blacklist controls exist. GoPlus reports zero buy and sell tax and no honeypot signal. Slither was not run.
The contract was AI-scanned using the verified source and supplied GoPlus evidence. Additional medium-risk concerns are tax-wallet withdrawal privileges and a permanent blacklist mechanism. No verified mint function, proxy, adjustable positive tax, or honeypot behavior was identified.
Trust score: 42/100. Source verified: Yes. Chain: ethereum. Contract: 0x405848c80099e3e657db48057f8042ead494548b.
This report was last modified on 2026-09-19 and contains 2 material findings.
medium finding: Tax wallet can withdraw contract ETH and ERC20 balances
The tax wallet retains independent authority after ownership renunciation to transfer ETH and arbitrary ERC20 tokens held by the contract. It can also swap the contract's token balance for ETH and forward the proceeds to itself. This is centralized asset custody and could remove accumulated fee or inventory balances.
Evidence: manualSend() and manualSwap() require only _msgSender()==_taxWallet and forward ETH to _taxWallet. manualSendTokens() allows _taxWallet or owner() to transfer any ERC20 balance, including the token's own balance, to _taxWallet. The tax wallet is assigned to the deployer in the constructor and is not cleared by renounceOwnership().
Recommendation: Use a multisig or transparent treasury policy, restrict withdrawals to documented fee balances, emit withdrawal events, and disclose the tax-wallet address and its operational authority.
medium finding: Permanent blacklist and bot-blocking controls can lock transfers
The source allows the owner to permanently block arbitrary senders and recipients. There is no removal function, so any address blocked before ownership was renounced remains unable to transfer or approve. The same transfer restrictions apply to ordinary transfers and transferFrom operations.
Evidence: addBlocked() sets _blockedAddresses[addresses_[i]]=true with no corresponding unblocking function. transfer(), approve(), transferFrom(), and _transfer() revert when the sender or recipient is blocked. addB() similarly creates permanent bot restrictions. GoPlus reports is_blacklisted=1. GoPlus also reports owner_address=0, so current ability to add new entries could not be confirmed from the supplied evidence.
Recommendation: Publish the blocked-address state and historical events, provide a governance-controlled removal mechanism if restrictions are required, and disclose any permanently restricted wallets.