Security

What the contracts do

FlazeCoinFactory deploys a coin clone and a curve clone per launch. The coin address is rejected unless it ends in 0x2222. The curve is a constant-product virtual AMM. Buys and sells take a protocol / creator / ecosystem fee with queued fallbacks. At the configured BNB target the curve adds liquidity to an allowlisted Pancake V2 router, burns LP, and renounces the token. Coin.sol is a BEP-20; standard launches have no transfer tax. Tax launches lock buy/sell marketing (cap 5%) and optional RFI reflections (cap 5%) at initialize — there is no setter. Curve↔pair transfers skip all fees so graduation LP stays exact. The coin exposes owner() / getOwner() (the curve, then address(0) after migrate). setPair, openDex and renounce are one-shot and only callable by the curve. There is no setExempt whitelist and no extcodesize antibot.

Live parameters the factory will accept: supply in {1M, 10M, 100M, 1B}, max wallet 2-5%, trade fee capped at 10%, DEX router from the owner allowlist. For token scanners, submit the FlazeCoin implementation (coinImpl) — not the whole factory file, which contains EIP-1167 clones and the FlazeReward minter hook.

Coin and curve addresses are EIP-1167 clones created with CREATE2. They are live on chain immediately. BscScan still shows them as empty wallets until its indexer sees the 45-byte proxy bytecode and verifyproxycontract binds them to the verified implementation. Open Token or Contract, not the default Transactions tab — creation is an internal call on the factory, so the clone has no external txs of its own. Verify the factory in Admin first so clones can similar-match.

Guards in this set

• S-01Creator-chosen supply

  Launches may mint 1M, 10M, 100M, or 1B. Virtual token reserves scale with that supply. Buys cannot spend the last 20% of inventory. At graduation the LP is sized so Pancake spot equals the curve spot; leftover tokens burn to 0xdead.

• S-02Max wallet 2-5%

  Creators pick 2, 3, 4, or 5%. The on-chain check is still balance strictly below total * pct / 100.

• S-04Coin addresses end in 2222

  Coins deploy with CREATE2. The factory reverts unless the address ends in 0x2222. The site mines a salt before the launch tx.

• X-01Reentrancy on factory create

  createLaunch uses a reentrancy lock. A hostile fee wallet cannot re-enter and clone launches with the same BNB.

• X-03Curve inventory reserve

  Buys cannot spend the 20% of supply reserved for the DEX pool. Graduation cannot be starved of inventory.

• H-01Router allowlist

  createLaunch requires the router to be on an owner-managed allowlist.

• M-02Queued fee payments

  Hostile or broken recipients cannot brick buy or sell.

• T-01Optional tax, 5% cap, immutable

  Creators pick standard or tax. Buy and sell marketing each cap at 500 bps and pay native BNB to a wallet set at create. Reflections are a separate 500 bps cap. No function can change those values. Zero-rate launches keep the original curve math.

• T-02Migrate skips token tax

  Transfers between the curve and its Pancake pair take no marketing or reflections, so LP amounts still match the curve spot. Sells credit the tokens actually received so a sell reflection cannot desync reserves.

• T-03RFI debit/credit (C-01)

  Excluded accounts (curve, factory, pair, dead, token) debit and credit rOwned by the reflected amount. They are never rebased with tOwned * currentRate, so a passive holder cannot lose balance when someone else pays a reflection fee.

• T-04Marketing swap before the sell (H-01 / M-01)

  Accumulated tax tokens swap to BNB before the seller’s tokens are credited to the pair, so a nested Pancake sell cannot see amountIn ≈ 0. Swap size is capped at 0.5% of supply and only fires above a 0.01% threshold.

• T-05Net slippage

  Buy minTokensOut is the tokens the wallet actually receives after reflection. Sell minEthOut is the BNB sent after protocol and marketing fees. Factory create refunds unused seed, not the whole native balance.

• T-06No hidden owner

  owner() and getOwner() return the curve until migrate, then address(0). Initialize can only be called by the factory. There is no mint, pause, blacklist, or setExempt on the coin.