YIN (阴) security report
SecureChain Radar AI-scanned the verified YIN contract on BSC. GoPlus found no confirmed honeypot, minting, blacklist, pause, proxy, or selfdestruct signals. Slither was not run. Material findings include approximately 69.1% supply held by the owner, owner-controlled migration that can keep pool transfers restricted, initialization-time tax configuration that can block trading if misconfigured, and external dividend and tax processor dependencies that can affect transfers and tax balances.
The contract does not show a confirmed honeypot or owner mint function, and GoPlus reports no minting, blacklist, pausing, or proxy signals. The main material risk is concentration: GoPlus reports the owner address holds 691,174,209.6256979 of 1,000,000,000 tokens, or approximately 69.1%, creating substantial sell-pressure and market-loss risk. Owner-controlled migration can also keep pool transfers restricted while the token remains in BondingCurve state.
Trust score: 45/100. Source verified: Yes. Chain: bsc. Contract: 0x2af1ac347550ae71f1bbc4b9590b5ca10bee7777.
This report was last modified on 2026-09-19 and contains 6 material findings.
high finding: Extreme owner token concentration creates major dump and governance risk
A single owner-controlled address holds approximately 69.1% of the total token supply. A sale or transfer of a material portion of this balance could cause severe price impact and losses for other holders. This is a market and centralization risk rather than proof of malicious intent.
Evidence: GoPlus reports total_supply=1000000000, owner_address=0xe2ce6ab80874fa9fa2aae65d277dd6b8e65c9de0, owner_balance=691174209.6256979, and owner_percent=0.691174.
Recommendation: Disclose the holder allocation and vesting plan, use transparent lockups or multisignature custody where applicable, and monitor large transfers from the owner address before trading significant value.
high finding: Owner-controlled migration can keep pool transfers restricted
While the pool state is BondingCurve, every transfer involving a configured pool reverts. Only the owner can call startMigration() and finalizeMigration(), which are required to move the contract through its migration states. If the owner delays or fails to complete migration, trading through the configured pools can remain unavailable.
Evidence: _transfer() requires !pools[from] && !pools[to] in BondingCurve state. startMigration() and finalizeMigration() are both protected by onlyOwner and are the only exposed state-transition functions for leaving BondingCurve and completing migration.
Recommendation: Use a documented migration timeline, multisignature ownership, and an independently verifiable emergency or timeout mechanism so pool activation does not depend indefinitely on one private key.
medium finding: Low liquidity amplifies execution and concentration risks
The supplied project data reports approximately $13,039.71 in liquidity. With the owner holding approximately 69.1% of supply, this liquidity level may be insufficient to absorb large sales and can produce severe price impact or high exit slippage. This is an economic risk, not a confirmed contract exploit.
Evidence: Project metadata reports liquidityUsd=13039.71. GoPlus reports the PancakeV2 pair with liquidity="0.00000000" and liquidity_type="UniV2", which is inconsistent with the project-level liquidity figure and should be independently verified.
Recommendation: Verify reserves directly on-chain, disclose locked or unlocked liquidity status, and avoid relying on the aggregate liquidity figure until the pair reserves and LP ownership are confirmed.
medium finding: Initialization permits blocking tax rates and permanent configuration risk
The initializer accepts buyTax and sellTax as uint16 values without an explicit maximum below 10000 basis points. Rates above 10000 make _taxedTransfer calculate a tax greater than the transfer amount, causing the subtraction of remainingAmount to revert. Because these parameters and the external processor addresses are set only during initialization, a bad or abusive deployment configuration can make pool buys or sells fail.
Evidence: initialize() stores params.buyTax and params.sellTax directly into poolState. _getTaxWithPoolState() computes amount * rate / 10000, while _taxedTransfer() executes uint256 remainingAmount = amount - tax. No require limits the rates to at most 10000 basis points.
Recommendation: Enforce buy and sell tax limits at or below 10000 basis points, preferably with a lower documented maximum, and publish the initialization transaction and resulting pool-state values before users trade.
medium finding: External dividend contract can revert ordinary token transfers
When dividendContract is nonzero, every applicable transfer calls IDividend.setShare() for the sender and recipient. Any revert from that external contract is propagated through DividendShareUpdateFailed, reverting the entire token transfer. A faulty, paused, incompatible, or compromised dividend contract could therefore create a transfer denial condition for non-pool addresses.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare() in try/catch and explicitly reverts with DividendShareUpdateFailed when either call fails. dividendContract is assigned during initialize() and has no setter or fallback path in the token.
Recommendation: Ensure the dividend contract is independently audited and operational, consider making share updates non-blocking or adding a controlled disable mechanism, and test transfers when the dividend service is unavailable.
medium finding: Tax-processing failure transfers the entire tax-token balance to the configured processor
If TaxProcessor.processTaxTokens() reverts, the catch branch transfers the contract's entire token balance to taxProcessor rather than only the current taxAmount. This can sweep taxes accumulated from earlier transfers to the external processor without an explicit recovery or user withdrawal path.
Evidence: In _processTax(), the catch branch reads balanceOf(address(this)) and calls _plainTransfer(address(this), taxProcessor, remainingBalance). The taxProcessor address is supplied during initialization and is not changeable through an exposed setter.
Recommendation: Limit fallback transfers to the intended current amount, add accounting and event transparency for residual balances, and use a verified processor address controlled through documented governance.