PUBLIC DISCLOSURE

Contracts, verification, and administrator permissions

Review the deployed addresses, current on-chain fee configuration, verification source, upgradeability model, and internal engineering security findings before using AirdropDesk.

View verification source Download review PDF Read full findings

On-chain configuration and verification status checked 13 July 2026. This is an internal engineering review, not an independent third-party audit.

DEPLOYMENTS

Supported mainnet contracts

All four contracts currently charge 0.01 USDC per recipient and limit each contract call to 300 recipients.

Network	Contract address	Source status	Explorer
Ethereum Chain 1	`0x3FFEB97DABA42CDfeECB1200f190477C991c432b`	Exact match verified	Etherscan
BNB Chain Chain 56	`0x1CfF989BF2464586BCfA4Edd0f1CCa791c11006E`	Exact match verified	BscScan
Arbitrum One Chain 42161	`0x9209618E0b2B1EA085C5d8a3DB613768A9c9de15`	Exact match verified	Arbiscan Blockscout
Base Chain 8453	`0xF2b32a7D21827AB3f55182Cf31523E7523bCEdd1`	Exact match verified	BaseScan

Shared executable-logic hash 0xea91b4897b1bf1fe18f9fba628f727b553ac05cb730c12b9ff868d10a6739abf The full runtime hashes differ only because each deployment carries different Solidity IPFS metadata.

SOURCE VERIFICATION

Explorer verification package

The original constructor values must be used for verification even though the live owner later changed the price from 0.30 to 0.01 USDC.

Compiler Solidity 0.8.34

Full version: v0.8.34+commit.80d5c536

Optimizer Disabled

Runs field 200, EVM version default.

Contract BulkAirdropWithFee

Use the Remix single-file source linked above.

Constructor arguments for all chains Download ABI

CONTROL MODEL

Non-upgradeable contract with disclosed owner controls

Owner on all four chains 0xfD148d89eF7D87FFbB18183DbE50EA3baD67FF7c The same address is currently the service-fee recipient.

Owner can

Change the service token, unit price, and fee recipient.
Set the batch limit between 1 and 500.
Transfer ownership to another non-zero address.

Owner cannot

Replace deployed bytecode or upgrade an implementation.
Start a distribution from a user's wallet.
Pull tokens without a user-initiated contract call.
Withdraw arbitrary user funds from the contract.

INTERNAL SECURITY REVIEW

Findings and residual risks

No critical transfer-loop issue was found. Two medium trust risks and two low operational risks remain open.

Medium

No maximum-fee parameter

The contract reads the mutable price when a transaction is mined. The frontend now approves the exact previewed fee, so a higher fee cannot be collected through that approval; users should still revoke older or larger allowances.

Medium

Immediate owner configuration changes

Pricing and recipient settings have no timelock. Multisig ownership and delayed changes are recommended.

Low

No pause mechanism

The deployed version cannot pause new calls during an incident.

Low

No accidental-token recovery

Tokens transferred directly to the contract address cannot be recovered.

Download internal review PDF Read complete review

WALLET CONNECTIVITY

Reown AppKit and WalletConnect are active

AirdropDesk supports official Reown wallet selection, WalletConnect QR sessions, mobile deep links, and session reconnection across the supported EVM networks. Email and social login are disabled.

Read wallet architecture note