False positive (Base/EVM): every BaseStonk V7 holder-rewards contract flagged 'known malicious', blocking buys in Phantom

[Xipzer]

Project: BaseStonk (https://basestonk.io), a Uniswap v4 token launchpad on Base (8453)
Contact: dev@basestonk.io · Telegram @Xipzer

What users see: buying any token launched on our current (V7) launcher is blocked as "This is a deceptive request… A known malicious address 0x… is involved", both on basestonk.io and through other routers. The flagged address is the token's holder-rewards (dividend) contract, which every transfer of the token notifies.

Why we believe it is a false positive (measured, reproducible):

• Queried the security-alerts endpoint for every holder-rewards contract we have deployed: all 16 from the V7 rewards factory are "Malicious: known malicious address"; all 15 from our previous V6 factory (same design) are "Benign" (Fisher exact p ≈ 3e-9).
• A V7 rewards contract was already flagged 8 hours after deployment, having never sent a single transfer; 10 of the 16 flagged contracts have zero deliveries. So the flag is not caused by behaviour.
• The tokens, the launcher, the hook, the swap router and both factories are all "Benign". GoPlus, ScamSniffer, ChainPatrol and eth-phishing-detect show nothing for our domain or contracts.

What the contracts do: one rewards contract per launched token, deployed by our factory 0x08355C1B7Fb50a3568a503C66a615E162190bc42 for our launcher 0x4BC0E8c2caaB145612956652A5668864FfcC7AF7. It receives a share of each trade's fee and pays it pro rata to holders. It holds no user approvals and cannot move anyone's tokens. Source verified on BaseScan, e.g. https://basescan.org/address/0x7372a0038eb6d1f9eabfec8fce9badeee840c5f1#code

Flagged addresses (Base):
0x7372a0038eb6d1f9eabfec8fce9badeee840c5f1, 0x7224c4bacb00f143399fce73cf25ec24e74a8671, 0xd14669ba0a656a4e41129a2ad7610725bd4001f3, 0xb0871ff0d4f6b8de48ca8793a2daf4bee763fbab, 0xb24dc2982d51dc8f55bfaa7e31fdc9dcc29bf0f7, 0x83469ad3733c18ef4182c486d34d55de2c934fff, 0xef47c62d3fee23eb4ea805c2d9ed37204b349508, 0xd18953e5701759a935cada53b5b4db9a7ca2f9ca, 0xe7ab8616db0bda887e1c85435c2ee316a0cc40e3, 0x33bddb766c918743b4c30a855d6a7827288fc077, 0x8065b372a19b5a929870ee5b4dbd99639fea215e, 0xa016040a0691ddd19d4869527589bc20973e0ba3, 0x29c21e852b62b337a04f94d3b1d7cdce23499d59, 0x50149ca572ce00042f14cd25965c3b1d537c6602, 0xd25248a7bc728c01b1c378f8d6f83290143592ec

Already filed: Blockaid false-positive report and developer verification (report.blockaid.io, Oct 10 and Oct 12).

Ask: please clear these, and ideally every contract deployed by factory 0x08355C1B7Fb50a3568a503C66a615E162190bc42, since each new launch deploys another one and is flagged within hours.