STOCK_DROPS.LOG » SECURITY_REVIEW.MD

Security review of the $TREASURE contract

2026-07-19 · reviewed with Claude (Fable 5) · commissioned by the community takeover

Before declaring the community takeover, the full verified source code of the Sherwood Treasure Chest contract was reviewed line by line together with Claude (Fable 5), and every claim below was checked directly against the chain. Nothing in this report relies on trust: each finding lists how you can reproduce it yourself.

SCOPE

FINDINGS

• Ownership is renounced and stays renounced. owner() returns the zero address. Every admin function in the code (distributeStockRewards, setSwapThreshold, setSwapSlippageBps, addStockToken, excludeFromRewards, setAutomatedMarketMakerPair, transferOwnership) is gated by onlyOwner and is therefore permanently dead. There is no way to re-take ownership.
• No hidden roles. The code contains exactly one privilege check (onlyOwner). The devWallet address stored in the contract has no powers anywhere in the code. No admin mappings, no backdoor modifiers.
• The rules are frozen. No mint function (supply is a constant), no blacklist, no pause, no trading switch (swapEnabled is constant true), no max-wallet or max-tx limits. The random 1 / 5 / 10% fee is hardcoded and cannot be changed by anyone.
• Not upgradeable. The contract is a single flat contract. No proxy pattern, no implementation slot, no delegatecall to arbitrary targets.
• Liquidity cannot be pulled. 100% of the LP tokens of the TREASURE/WETH pair are held by the burn address 0x…dEaD (sole holder, 30,512 LP). A rug is technically impossible regardless of what any wallet wants.
• The old dev holds zero tokens. The deployer wallet's current $TREASURE balance is 0. The initial 5% dev allocation (≈49.5M tokens) sits at the burn address. There is no dev bag waiting to be dumped.
• The reward engine runs without anyone's permission. Fees convert to tokenized stocks automatically on sells, and anyone can call processFees(). The caller earns a 2% share of the bought stock as a tip. The community can keep the machine running forever.
• The rewards are real and on-chain. The contract's public totalStockDistributed counters show tens of thousands of dollars of AAPL, AMD, GOOGL, NVDA, SPCX and TSLA already distributed to holders. The live figure on the front page is read from these counters.

MINOR OBSERVATIONS (not security issues)

• The original deployer address remains excluded from the trading fee forever (set in the constructor, no setter exists). Cosmetic: that wallet trades fee-free but has no other advantage.
• The reward stock list is frozen at the six launch stocks. Adding new ones required the owner, which no longer exists.
• swapThreshold and swap slippage are frozen at their launch values; fee processing happens in chunks once enough fees accumulate.
• The random fee uses block values as its randomness source. The chain's sequencer could in theory bias the roll. Irrelevant at memecoin scale.

VERIFY_IT_YOURSELF

1. Owner: open the contract on the explorer's read tab and call owner → returns 0x0000…0000.
2. Source: the same page shows the verified source. Search it for onlyOwner and confirm every admin function carries it.
3. LP burn: open the pair's holder list → the burn address is the only LP holder.
4. Distributed rewards: on the contract's read tab call totalStockDistributed with any of the six stock addresses listed in the source's _initStockTokens().

← back to $TREASURE