Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Alibaba Safe?

BABABBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 15, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades1/10Checks passed3 of 7Findings1 High · 2 Medium · 1 Low · 4 Info8
SummaryAI Copilot

The SecuritiesToken is an upgradeable ERC-20 token designed with extensive administrative control.

Read the full analysis
What raised the score
  • A privileged address can replace a contract every transfer depends on
  • Owner can change the buy/sell tax
  • A privileged address can change transfer or wallet limits
  • Mintable supply — no cap found, dilution unbounded
  • Upgradeable proxy — the admin can replace the logic
  • Ownership status UNKNOWN
  • Liquidity not locked
  • Top-10 concentration > 50%
  • The deployer has launched a honeypot before
Exact factors
  • A privileged address can replace a contract every transfer depends on
  • Owner can change the buy/sell tax
  • A privileged address can change transfer or wallet limits
  • Mintable supply — no cap found, dilution unbounded
  • Upgradeable proxy — the admin can replace the logic
  • Ownership status UNKNOWN (owner could not be resolved)
  • Liquidity NOT locked (100% of the pool; this pool is 89% of DEX liquidity) — held by independent providers — market-depth risk
  • Top-10 concentration > 50% (92.1% total → 67.4% effective; 66.2% in EOAs, 3.0% in contracts; 22.8% burned, locked or in pools excluded)
  • The deployer has launched a honeypot before

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 153 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 15, 202635,218 holders
3.0%66.2%Wallets22.8%DEX pools7.9%
66.2%Wallets22.8%DEX pools7.9%
ContractsWalletsDEX poolsEveryone elseBubble area = share of supply
92.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking3.0%
  • Walletsanonymous holders, free to sell66.2%
  • DEX poolsthe pools' own liquidity22.8%
  • Everyone else35,208 holders7.9%
Effective concentrationwhat the score reads67.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 15, 2026

Liquidity

as of audit · Oct 15$2.86M across 30 pairs
Show 4 more pairs

The 20 remaining pairs hold $105.6K between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$2.53MShare of depth88.6%
Top-1 Unlocked Holder70.8%
Top-3 Unlocked88.4%
Unlocked LP held by
0x5b0d…a9b90x556b…d59e0x8145…09920x92af…33530xcece…cbe80xef6e…cce70xe27a…5e840x9afa…8b470x8815…76260x0e5f…c311

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High2 Medium1 Low4 Info
High

Centralized Control Over Critical External Contracts

A privileged address, specifically the one holding the DEFAULT_ADMIN_ROLE, has the ability to replace the PauseManager and Compliance contracts. These external contracts are called during token transfers to determine if a transfer is allowed or paused. If the controlling address is compromised, it could redirect token logic to a malicious contract, potentially blocking all transfers or imposing arbitrary rules.CP-03

Issue

A privileged address, specifically the one holding the DEFAULT_ADMIN_ROLE, has the ability to replace the PauseManager and Compliance contracts. These external contracts are called during token transfers to determine if a transfer is allowed or paused. If the controlling address is compromised, it could redirect token logic to a malicious contract, potentially blocking all transfers or imposing arbitrary rules.

Fix

Token holders should be aware that the administrator can change the core logic governing transfers by updating the PauseManager (via setPauseManager function) and Compliance (via setCompliance function) contract addresses. This power should be secured by a multi-signature wallet and any changes should be publicly announced with sufficient lead time.

Status

Unresolved

Medium

Administrator Can Change Transfer Fees

The DEFAULT_ADMIN_ROLE has the power to modify the _uiMultiplier parameter using the setUIMultiplier function. This parameter directly influences the fees or amounts deducted during token transfers. A malicious or compromised administrator could set excessively high fees, impacting the economic viability of token transactions for users.CP-07

Issue

The DEFAULT_ADMIN_ROLE has the power to modify the _uiMultiplier parameter using the setUIMultiplier function. This parameter directly influences the fees or amounts deducted during token transfers. A malicious or compromised administrator could set excessively high fees, impacting the economic viability of token transactions for users.

Fix

Token holders should understand that the administrator can change the fees associated with transfers using the setUIMultiplier function. It is recommended that any changes to transfer fees are communicated transparently and that the controlling role is secured with a multi-signature wallet to prevent unauthorized modifications.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 94.2% is held, unlocked, by 10 address(es) other than the owner/deployer. One of them — a wallet, 0x5b0d…a9b9 — holds 70.8% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 89% of the token's DEX liquidity; the other pools were not assessed.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 94.2% is held, unlocked, by 10 address(es) other than the owner/deployer. One of them — a wallet, 0x5b0d…a9b9 — holds 70.8% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 89% of the token's DEX liquidity; the other pools were not assessed.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Low

Administrator Can Change Transfer Limits

The DEFAULT_ADMIN_ROLE can adjust numeric limits checked during the transfer process, such as those related to the UI multiplier, via the setUIMultiplier function. While not directly a "fee," changes to this multiplier could indirectly affect perceived transfer amounts or introduce unexpected behavior related to how amounts are scaled or validated.CP-08

Issue

The DEFAULT_ADMIN_ROLE can adjust numeric limits checked during the transfer process, such as those related to the UI multiplier, via the setUIMultiplier function. While not directly a "fee," changes to this multiplier could indirectly affect perceived transfer amounts or introduce unexpected behavior related to how amounts are scaled or validated.

Fix

Token holders should be aware that the administrator can modify certain numeric parameters that might affect how transfers are processed, using the setUIMultiplier function. While this might not directly impose a fee, it could alter how amounts are calculated or validated. This control should be managed responsibly and transparently.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 92.1% of supply. Of that, 22.8% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 66.2% in wallets, 3.0% in other contracts. 35,218 holders in total.QA-HOLDERS

Issue

The ten largest holders own 92.1% of supply. Of that, 22.8% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 66.2% in wallets, 3.0% in other contracts. 35,218 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Listed, but not independently verified

Listed on CoinGecko as Alibaba (bStocks Tokenized Stock) (BABAB), market cap $9M, rank #1308. 35,218 holders.QA-IDENTITY

Issue

Listed on CoinGecko as Alibaba (bStocks Tokenized Stock) (BABAB), market cap $9M, rank #1308. 35,218 holders.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $2.9M (DexScreener, all pools). 24h trading volume $13.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $4.1M (DexScreener, all pools).QA-MARKET

Issue

Liquidity $2.9M (DexScreener, all pools). 24h trading volume $13.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $4.1M (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Tokenized real-world asset

A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $2.9M of DEX liquidity across 30 pools. Launch: 73 days of market history.QA-PROFILE

Issue

A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $2.9M of DEX liquidity across 30 pools. Launch: 73 days of market history.

Fix

Treat the issuer or custodian as the counterparty: check its custody reports and who may hold or redeem the token.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 15
Executive SummaryWhat the contract is and what the review found

The SecuritiesToken is an upgradeable ERC-20 token designed with extensive administrative control. Key functionalities like transfer rules, fees, and external compliance/pause mechanisms are centrally managed by a privileged role. While this allows for flexibility and regulatory compliance, it introduces significant centralization risks, as a compromise of the controlling address could lead to manipulation of token behavior or funds.

Technical6/10Medium risk

The SecuritiesToken is an upgradeable ERC-20 token leveraging OpenZeppelin's AccessControlEnumerableUpgradeable for robust role-based access management (7.3 Access Control). It integrates external PauseManagerClientUpgradeable and ComplianceClientUpgradeable contracts, allowing dynamic control over transfer logic (7.1 Architecture). However, the ability for a privileged role to replace critical external contracts (setPauseManager, setCompliance) and modify transfer parameters (setUIMultiplier) introduces a high technical risk (7.2 Code Security).

Governance1/10High risk

The token's economic model and governance are highly centralized, with a DEFAULT_ADMIN_ROLE controlling critical functions (7.5 Governance). This role can enable/disable minting and burning, set the UI multiplier which affects transfer fees, and change the token's name/symbol (7.4 Economic). While this provides flexibility for a regulated asset, it concentrates significant power, posing a high economic risk if the controlling entity acts maliciously or is compromised.

Upgrades1/10High risk

The SecuritiesToken is deployed via a Beacon Proxy pattern, enabling future upgrades to its logic (7.7 Upgrades). This design allows for bug fixes and feature enhancements without redeploying the token. However, the upgrade mechanism itself is controlled by a privileged role, meaning the administrator can unilaterally change the contract's entire logic, which is a medium risk if not managed securely.

Final RecommendationWhat to do about this score

It is crucial to secure the DEFAULT_ADMIN_ROLE with the highest possible standards, ideally using a robust multi-signature wallet solution with a high threshold for execution.

All changes to critical parameters, especially those affecting transfer logic, fees, or external contract addresses, should be communicated transparently to token holders. Consider implementing a time-lock mechanism for sensitive administrative actions to provide a window for review and reaction.

Contract & Record

1 audit on record
TypeBeaconProxy
NetworkBNB Chain
Token age2mo
Contract0x4ef9…f4ec
Deployer0x64fd…8d53
Proxy Upgrade Controls
Proxy TypeBeacon
ImplementationVerified source
Audit History
  1. Oct 15, 202681High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
NVIDIA CorpNVDAB · BNB Chain81HighGiggle TomTOM · BNB Chain81HighUnited StablesU · BNB Chain82HighCATBNB Chain82HighVortexPadVPAD · BNB Chain82HighAIOZ NetworkAIOZ · BNB Chain82High

Would You Like a More Detailed Audit of Alibaba?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page