ZKEr (ZKER) security report
Radar by SecureChain AI scanned ZKEr on Ethereum. The source shows fixed-supply ERC-20 behavior, but an immutable external distributor can cause transfers to revert. Slither was not run.
The primary identified risk is the immutable external transfer callback. If the configured distributor reverts, is unavailable, or applies restrictive behavior, ordinary ZKER transfers can fail. No direct owner mint, fee manipulation, blacklist, or upgrade path is present in the reviewed source.
Trust score: 68/100. Source verified: Yes. Chain: ethereum. Contract: 0xdeddc6d4beb9f3abaccbdaf45fbe1b7dab37dfef.
This report was last modified on 2026-10-07 and contains 2 material findings.
medium finding: Immutable external distributor can block ordinary token transfers
Every non-mint token transfer performs an external call to the configured distributor. A revert, gas failure, or restrictive implementation in that contract causes the enclosing transfer to revert, potentially preventing holders from moving tokens. The distributor address is immutable and cannot be replaced through LaunchToken functions.
Evidence: LaunchToken._update calls super._update(from, to, value), then, when from is not address(0) and distributor is not address(0), executes IHolderDistributor(distributor).onTransfer(from, to, value, balanceOf(from), balanceOf(to)). Because this call is not wrapped in error handling, any failure reverts transfer, transferFrom, and transfers initiated by integrations. The interface also shows the callback is an externally implemented function whose implementation is not included in the supplied source.
Recommendation: Verify the deployed distributor bytecode, access controls, gas behavior, and onTransfer implementation before relying on the token. Consider allowing a trusted governance process to disable or replace the hook, or isolate hook failures from ERC-20 transfer settlement if the design permits.
medium finding: GoPlus source-transparency signal conflicts with supplied source package
The supplied evidence contains a complete verified-source package, while GoPlus reports is_open_source as 0. This discrepancy reduces confidence that the analyzed source corresponds to the currently deployed bytecode or that external tooling can independently reproduce the review.
Evidence: GoPlus evidence reports "is_open_source":"0". The scan input separately supplies Solidity source for src/LaunchToken.sol and its dependencies, but Slither was not run.
Recommendation: Reconcile the deployed contract bytecode, compiler settings, and verification record with the supplied source before deployment or integration decisions. Treat source-dependent conclusions as conditional until the correspondence is confirmed.