On-chain security analysis — is it a scam or legit?
BNB ChainThe AlayaGovernanceToken contract is a standard ERC20 token implementation, primarily leveraging battle-tested OpenZeppelin Contracts.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x8815…288b0x6b94…b028No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The ERC20 contract does not include any administrative functions for emergency control, such as pausing transfers or blacklisting malicious addresses. While this enhances decentralization by removing single points of control, it also means there is no mechanism to mitigate severe exploits, respond to regulatory demands, or freeze funds in case of theft (7.3 Access Control, 7.8 Operations).
Evaluate the project's risk tolerance and operational needs. If emergency intervention capabilities are desired, consider integrating OpenZeppelin's Pausable or AccessControl contracts. If not, ensure the project's off-chain incident response plan accounts for the immutable nature of the token's operations.
Unresolved
msg.sender. This design choice results in a highly centralized initial distribution, where the deployer address holds the entire token supply at launch. While a common pattern for initial token deployment, it implies significant control by a single entity over the token's early circulation (7.4 Economic).I-01The constructor of the ERC20 contract mints the entire initial supply of 5,000,000,000 * 10^18 tokens directly to msg.sender. This design choice results in a highly centralized initial distribution, where the deployer address holds the entire token supply at launch. While a common pattern for initial token deployment, it implies significant control by a single entity over the token's early circulation (7.4 Economic).
Acknowledge and accept this centralized distribution as a design decision. If decentralization is a long-term goal, consider a phased distribution strategy or a multi-signature wallet for managing the initial supply.
Unresolved
The token's name, symbol, decimals (fixed at 18), and initial total supply are set immutably within the constructor. These parameters cannot be modified after deployment. This ensures consistency and predictability for users and integrated protocols (7.1 Architecture).
No action required. This is a standard and often desired characteristic for ERC20 tokens, providing clarity and preventing unexpected changes to fundamental token properties.
Unresolved
The AlayaGovernanceToken contract is a standard ERC20 token implementation, primarily leveraging battle-tested OpenZeppelin Contracts. The technical risk is low due to the use of well-audited libraries and minimal custom logic. Key design decisions include a centralized initial token distribution and the absence of emergency administrative controls.
The technical architecture is robust, built upon the latest OpenZeppelin ERC20 implementation (v5.1.0), which includes modern features like ERC-6093 custom errors and correct unchecked arithmetic. The contract adheres to the ERC20 standard, providing basic token functionalities (7.1 Architecture, 7.2 Code Security). The code is well-structured and follows best practices. There are no complex custom logic or external integrations that introduce significant technical attack vectors (7.6 External).
The economic model is that of a standard ERC20 token, with a fixed initial supply minted entirely to the deployer (7.4 Economic). This centralizes initial control over the token supply. There are no explicit governance mechanisms or complex economic incentives defined within the contract itself (7.5 Governance). The token's utility and broader economic implications would depend on its integration into a larger ecosystem.
The contract is implemented as a standard, non-upgradeable ERC20 token. There are no proxy patterns (e.g., UUPS, Transparent) or beacon proxies used, meaning the contract's logic cannot be modified post-deployment (7.7 Upgrades). This design choice eliminates upgrade-related risks but also removes the flexibility to fix bugs or add features in the future.
The AlayaGovernanceToken contract is a solid implementation of the ERC20 standard, benefiting from the security and reliability of OpenZeppelin Contracts.
It is recommended to thoroughly review the implications of the centralized initial token distribution and the absence of emergency controls, ensuring these design choices align with the project's long-term vision and risk tolerance. For future developments, consider implementing a multi-signature wallet for the deployer address if it retains significant control, and conduct comprehensive testing of any external integrations involving this token.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Alaya Governance Token (AGT) contract on BNB Chain is 0x5dbde81fce337ff4bcaaee4ca3466c00aecae274. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Alaya Governance Token is 31/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $1.33M.
As of Sep 4, 2026, the 10 largest holders own 56.2% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
