Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Allora Safe?

ALLOEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical4/10Governance1/10Upgrades1/10Checks passed1 of 5Findings1 Critical · 1 High · 1 Medium · 1 Low4
SummaryAI Copilot

This audit focuses on the provided OpenZeppelin ERC1967 Transparent Proxy contract.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $10k
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 70% (93.4% total → 89.6% effective; 87.0% in EOAs, 6.3% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $10k ($6,633 across 2 pairs — easily drained)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 80% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 80% of DEX liquidity)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 41 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
6.3%87.0%Wallets6.6%
6.3%87.0%Wallets6.6%
ContractsWalletsEveryone elseBubble area = share of supply
93.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking6.3%
  • Walletsanonymous holders, free to sell87.0%
  • Everyone elsethe rest of the supply6.6%
Effective concentrationwhat the score reads89.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$6.6K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$5.3KShare of depth80.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x7c9f…b301

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 High1 Medium1 Low
Critical

Unverified Implementation Contract Source Code

The core logic of the system resides in the implementation contract (AlloOFTUpgradeable at 0xb21c…6278), but its source code is not publicly verified. This prevents any security assessment of the actual business logic, making it impossible to identify vulnerabilities such as reentrancy, access control flaws, or economic exploits. Users and auditors cannot independently verify the contract's behavior or safety.C-01

Issue

The core logic of the system resides in the implementation contract (AlloOFTUpgradeable at ), but its source code is not publicly verified. This prevents any security assessment of the actual business logic, making it impossible to identify vulnerabilities such as reentrancy, access control flaws, or economic exploits. Users and auditors cannot independently verify the contract's behavior or safety.

Fix

Immediately verify and publish the source code for the AlloOFTUpgradeable implementation contract on block explorers. Conduct a thorough security audit of this implementation contract to identify and remediate any vulnerabilities. Ensure that all future implementation upgrades also have their source code verified.

Status

Unresolved

High

Lack of Timelock for Critical Operations (Upgrades)

While the upgrade mechanism is controlled by a 2-of-3 multisig, there is no timelock in place for executing upgrades. This means that once the required multisig approvals are obtained, an upgrade can be deployed instantly. This lack of a delay period prevents users, the community, or automated monitoring systems from reacting to a potentially malicious or erroneous upgrade before it takes effect, increasing the risk of irreversible damage or fund loss.H-01

Issue

While the upgrade mechanism is controlled by a 2-of-3 multisig, there is no timelock in place for executing upgrades. This means that once the required multisig approvals are obtained, an upgrade can be deployed instantly. This lack of a delay period prevents users, the community, or automated monitoring systems from reacting to a potentially malicious or erroneous upgrade before it takes effect, increasing the risk of irreversible damage or fund loss.

Fix

Integrate a timelock contract into the upgrade process. The ProxyAdmin should be owned by a timelock, which in turn is controlled by the multisig. This ensures that any proposed upgrade has a mandatory delay period (e.g., 24-72 hours) before it can be executed, allowing for review and potential intervention.

Status

Unresolved

Medium

Reliance on External Contracts for Core Logic

The security and functionality of the entire system are entirely dependent on the AlloOFTUpgradeable implementation contract. Any vulnerability within this external contract, whether due to design flaws, coding errors, or malicious intent, will directly impact the proxy and its users. This risk is exacerbated by the unverified source code of the implementation.M-01

Issue

The security and functionality of the entire system are entirely dependent on the AlloOFTUpgradeable implementation contract. Any vulnerability within this external contract, whether due to design flaws, coding errors, or malicious intent, will directly impact the proxy and its users. This risk is exacerbated by the unverified source code of the implementation.

Fix

Ensure rigorous security practices for the development, testing, and auditing of the implementation contract. Implement robust monitoring for the implementation contract's behavior and state. Consider formal verification or extensive fuzzing for critical components of the implementation.

Status

Unresolved

Low

Centralized Upgrade Authority

Although the upgrade authority is managed by a 2-of-3 multisig, this still represents a centralized point of control. If a majority of the multisig signers are compromised, collude, or act maliciously, they could unilaterally upgrade the contract to a harmful implementation, potentially leading to loss of funds or system compromise.L-01

Issue

Although the upgrade authority is managed by a 2-of-3 multisig, this still represents a centralized point of control. If a majority of the multisig signers are compromised, collude, or act maliciously, they could unilaterally upgrade the contract to a harmful implementation, potentially leading to loss of funds or system compromise.

Fix

While a multisig is a strong control, consider further decentralizing the upgrade authority over time, possibly by integrating a more distributed governance mechanism or a larger, more diverse set of signers. Implement strict operational security procedures for all multisig signers, including hardware wallets, secure key management, and multi-factor authentication.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit focuses on the provided OpenZeppelin ERC1967 Transparent Proxy contract. The proxy itself utilizes well-audited and standard components. However, the critical finding is that the source code for the underlying implementation contract (AlloOFTUpgradeable) is unverified, preventing a comprehensive security assessment of the system's core logic. Additionally, while upgrade control is managed by a multisig, the absence of a timelock for upgrades introduces a higher operational risk.

Technical4/10Medium risk

The proxy contract (ERC1967Proxy) is built upon battle-tested OpenZeppelin libraries, ensuring a robust foundation for its core functionality (7.2 Code Security). The architecture correctly implements the EIP-1967 standard for storage slots, minimizing collision risks (7.1 Architecture). However, a critical technical risk is the unverified source code for the AlloOFTUpgradeable implementation contract, making it impossible to assess its security and potential vulnerabilities (7.2 Code Security). This lack of visibility into the core logic significantly elevates the overall technical risk.

Governance1/10High risk

The governance model for upgrades employs a 2-of-3 multisig for the ProxyAdmin (7.5 Governance), which is a strong access control mechanism, reducing the risk of a single point of failure (7.3 Access Control). This setup requires multiple approvals for critical operations like upgrades. However, the absence of a timelock for upgrades means that once the multisig approves an upgrade, it can be executed immediately, leaving no time for community review or reaction to a potentially malicious change (7.8 Operations). This introduces a moderate economic risk if the multisig signers are compromised or collude.

Upgrades1/10High risk

The system utilizes the EIP-1967 Transparent Proxy pattern, a well-established and secure method for upgradeability (7.7 Upgrades). This pattern correctly separates the admin interface from the implementation, preventing function selector clashes. Upgrades are controlled by a 2-of-3 multisig, enhancing security against unauthorized changes. However, the unverified source code of the implementation contract poses a significant risk, as any vulnerability introduced in an upgrade cannot be independently verified (7.7 Upgrades). Furthermore, the lack of a timelock for upgrade execution increases the operational risk, as upgrades can be deployed instantly without a grace period (7.8 Operations).

Final RecommendationWhat to do about this score

Prioritize verifying and thoroughly auditing the source code for the AlloOFTUpgradeable implementation contract to ensure its security and integrity.

Implement a timelock mechanism for all critical administrative operations, especially contract upgrades, to provide a delay period for public scrutiny and emergency response. Regularly review and update multisig signers and their security practices to maintain robust access control over the system's upgradeability.

Contract & Record

1 audit on record
TypeTransparentUpgradeableProxy
NetworkEthereum
Token age6mo
Contract0x8408…0489
Deployer0x09aa…5f68
Proxy Upgrade Controls
Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin → Multisig 2-of-3
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Allora security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202689Critical
  2. Jul 23, 202691Critical

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
CalderaERA · Ethereum90CriticalCOTIEthereum88Criticaldmt-natEthereum88CriticalBluzelle TokenBLZ · Ethereum90CriticalJPY CoinJPYC · Ethereum88CriticalusocksEthereum91Critical

Would You Like a More Detailed Audit of Allora?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page