YIN (阴) security report
SecureChain Radar AI-scanned the verified YIN contract on BSC. GoPlus found no confirmed honeypot, minting, blacklist, pause, proxy, or selfdestruct signals. Slither was not run.
The contract does not show a confirmed honeypot or owner mint function, and GoPlus reports no minting, blacklist, pausing, or proxy signals. Owner-controlled migration can also keep pool transfers restricted while the token remains in BondingCurve state.
Trust score: 45/100. Source verified: Yes. Chain: bsc. Contract: 0x2af1ac347550ae71f1bbc4b9590b5ca10bee7777.
This report was last modified on 2026-10-05 and contains 4 material findings.
high finding: Owner-controlled migration can keep pool transfers restricted
While the pool state is BondingCurve, every transfer involving a configured pool reverts. Only the owner can call startMigration() and finalizeMigration(), which are required to move the contract through its migration states. If the owner delays or fails to complete migration, trading through the configured pools can remain unavailable.
Evidence: _transfer() requires !pools[from] && !pools[to] in BondingCurve state. startMigration() and finalizeMigration() are both protected by onlyOwner and are the only exposed state-transition functions for leaving BondingCurve and completing migration.
Recommendation: Use a documented migration timeline, multisignature ownership, and an independently verifiable emergency or timeout mechanism so pool activation does not depend indefinitely on one private key.
medium finding: Initialization permits blocking tax rates and permanent configuration risk
The initializer accepts buyTax and sellTax as uint16 values without an explicit maximum below 10000 basis points. Rates above 10000 make _taxedTransfer calculate a tax greater than the transfer amount, causing the subtraction of remainingAmount to revert. Because these parameters and the external processor addresses are set only during initialization, a bad or abusive deployment configuration can make pool buys or sells fail.
Evidence: initialize() stores params.buyTax and params.sellTax directly into poolState. _getTaxWithPoolState() computes amount * rate / 10000, while _taxedTransfer() executes uint256 remainingAmount = amount - tax. No require limits the rates to at most 10000 basis points.
Recommendation: Enforce buy and sell tax limits at or below 10000 basis points, preferably with a lower documented maximum, and publish the initialization transaction and resulting pool-state values before users trade.
medium finding: External dividend contract can revert ordinary token transfers
When dividendContract is nonzero, every applicable transfer calls IDividend.setShare() for the sender and recipient. Any revert from that external contract is propagated through DividendShareUpdateFailed, reverting the entire token transfer. A faulty, paused, incompatible, or compromised dividend contract could therefore create a transfer denial condition for non-pool addresses.
Evidence: _afterTokenTransfer() calls IDividend(dividendContract).setShare() in try/catch and explicitly reverts with DividendShareUpdateFailed when either call fails. dividendContract is assigned during initialize() and has no setter or fallback path in the token.
Recommendation: Ensure the dividend contract is independently audited and operational, consider making share updates non-blocking or adding a controlled disable mechanism, and test transfers when the dividend service is unavailable.
medium finding: Tax-processing failure transfers the entire tax-token balance to the configured processor
If TaxProcessor.processTaxTokens() reverts, the catch branch transfers the contract's entire token balance to taxProcessor rather than only the current taxAmount. This can sweep taxes accumulated from earlier transfers to the external processor without an explicit recovery or user withdrawal path.
Evidence: In _processTax(), the catch branch reads balanceOf(address(this)) and calls _plainTransfer(address(this), taxProcessor, remainingBalance). The taxProcessor address is supplied during initialization and is not changeable through an exposed setter.
Recommendation: Limit fallback transfers to the intended current amount, add accounting and event transparency for residual balances, and use a verified processor address controlled through documented governance.