wildebeest (WILDEBEEST) security report
SecureChain AI scanned the verified WILDEBEEST contract with GoPlus and Slither evidence. Material findings include a tax-wallet allowance bypass and owner-controlled rescue and liquidity setup. No minting, blacklist, proxy upgradeability, or source-level sell restriction was found.
The contract was AI scanned and has a high-risk transferFrom authorization flaw: transactions originating from the tax wallet bypass allowance reduction, allowing that address to transfer tokens from arbitrary holders. No direct mint or blacklist mechanism was found.
Trust score: 62/100. Source verified: Yes. Chain: ethereum. Contract: 0xfc211056d5aeb071836a81f7c17d3d3844bc6c7b.
This report was last modified on 2026-10-08 and contains 1 material finding.
high finding: Tax-wallet origin bypasses transferFrom allowance checks
When tx.origin equals the private _taxWallet address, transferFrom skips the allowance decrement entirely. The tax wallet can therefore call transferFrom against arbitrary token holders without an allowance, subject only to the holder's token balance.
Evidence: transferFrom() calls _transfer(sender, recipient, amount), then executes _approve(...).sub(amount) only when _taxWILDEBEESTR2ZHP0Z2JQ9Payer() != _taxWallet. _taxWILDEBEESTR2ZHP0Z2JQ9Payer() returns origin() through assembly, and _taxWallet is initialized to the deployer in the constructor.
Recommendation: Remove all tx.origin authorization logic and always enforce allowance checks in transferFrom. If a privileged recovery function is required, isolate it, document it, and protect it with explicit role controls and limits rather than silently bypassing ERC-20 allowances.