Woof (WOOF) security report
Radar by SecureChain AI scanned Woof’s verified BNB Smart Chain source. The review found a platform-tax accounting mismatch and centralized ETH rescue authority. Slither was skipped.
Yes. The verified source contains two medium-severity business-logic and privilege risks. The contract does not expose minting or blacklist controls in the reviewed Token implementation, and GoPlus reports the token as non-mintable and non-proxy. Slither was skipped.
Trust score: 70/100. Source verified: Yes. Chain: bsc. Contract: 0x3c8a098cb87fdd41e82de1dfdb85dabf41888888.
This report was last modified on 2026-11-04 and contains 2 material findings.
medium finding: Configured platform tax is not included in the total transfer tax
Token.init stores platformTaxBps but sets totalTaxBps equal only to marketingTaxBps. As a result, platformTaxBps does not add an independent fee to transfers. Instead, it only determines how the marketing tax amount is split between platformTokens and marketingTokens.
Evidence: In Token.init, `platformTaxBps = c.platformTaxBps;` is followed by `totalTaxBps = c.marketingTaxBps;`. In _transfer, the tax is calculated as `(amount * totalTaxBps) / 10000`, and _accrueTax then derives the platform allocation from that already-limited amount using `tax * platformTaxBps / 10000`.
Recommendation: Set totalTaxBps to the intended combined rate, or rename and document the parameters if platformTaxBps is intended only as an allocation ratio. Add tests covering zero and nonzero platform tax values and verify the emitted tax and bucket amounts against the published fee model.
medium finding: Factory owner has arbitrary ETH withdrawal authority over deployed tokens
The Factory owner can invoke rescueTokenETH for any nonzero token address, and the Token contract authorizes the Factory to send any amount of its ETH balance to an arbitrary nonzero recipient. This is a centralized withdrawal capability over native currency held by deployed Token contracts.
Evidence: Factory.rescueTokenETH is restricted by `onlyOwner` and calls `Token(payable(tokenAddr)).rescueETH(to, amount)`. Token.rescueETH requires only `msg.sender == factory`, accepts an arbitrary `to` address other than zero, and transfers the requested amount with `payable(to).call{value: amount}("")`.
Recommendation: Restrict rescue operations to demonstrably accidental ETH, use a multisig or timelocked administrator, emit and monitor governance events for rescue requests, and consider enforcing a documented recipient or recovery policy.