Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is ANDY Safe?

BNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance6/10Upgrades9/10Checks passed7 of 7Findings1 Critical · 1 High · 1 Info3
SummaryAI Copilot

The FourERC20 contract implements a standard ERC-20 token using OpenZeppelin libraries.

Read the full analysis
What raised the score
  • Top-10 concentration > 50%
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
Exact factors
  • Top-10 concentration > 50% (91.7% total → 69.5% effective; 54.8% in EOAs, 36.9% in contracts — heavy)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 47 of 7 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
36.9%Contracts54.8%Wallets8.3%
36.9%Contracts54.8%Wallets8.3%
ContractsWalletsEveryone elseBubble area = share of supply
91.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking36.9%
  • Walletsanonymous holders, free to sell54.8%
  • Everyone elsethe rest of the supply8.3%
Effective concentrationwhat the score reads69.5%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$132.8K

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$132.8KShare of depth100.0%
LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address

Security Findings

1 Critical1 High1 Info
Critical

Non-Functional Token: Missing Initialization and Supply Mechanism

The FourERC20 contract, as provided, lacks a constructor to properly initialize essential token metadata (name, symbol) and does not include any public function to mint an initial supply of tokens. The internal _init function is never invoked, and the _mint function is only internal. Consequently, upon deployment, the token will have an empty name, symbol, and a _totalSupply of zero, rendering it completely non-functional and unusable for its intended purpose as an ERC-20 token. (7.1 Architecture, 7.4 Economic)C-01

Issue

The FourERC20 contract, as provided, lacks a constructor to properly initialize essential token metadata (name, symbol) and does not include any public function to mint an initial supply of tokens. The internal _init function is never invoked, and the _mint function is only internal. Consequently, upon deployment, the token will have an empty name, symbol, and a _totalSupply of zero, rendering it completely non-functional and unusable for its intended purpose as an ERC-20 token. (7.1 Architecture, 7.4 Economic)

Fix

Implement a constructor in FourERC20 to: 1) call _init with the desired token name and symbol, and 2) mint an initial supply of tokens to a designated address (e.g., the deployer). Alternatively, provide a public, access-controlled minting function if dynamic supply management is intended.

Status

Unresolved

High

Lack of Access Control for Potential Privileged Functions

The contract includes internal _mint and _burn functions, which are typically associated with privileged operations to manage token supply. However, the contract currently lacks any access control mechanisms (e.g., Ownable, AccessControl). If public functions are later added to expose these internal minting or burning capabilities, the absence of access control would allow any external caller to manipulate the token supply, leading to severe economic instability and potential rug pulls. (7.3 Access Control, 7.4 Economic)H-01

Issue

The contract includes internal _mint and _burn functions, which are typically associated with privileged operations to manage token supply. However, the contract currently lacks any access control mechanisms (e.g., Ownable, AccessControl). If public functions are later added to expose these internal minting or burning capabilities, the absence of access control would allow any external caller to manipulate the token supply, leading to severe economic instability and potential rug pulls. (7.3 Access Control, 7.4 Economic)

Fix

If public minting or burning functions are introduced in a derived contract, integrate a robust access control mechanism (e.g., OpenZeppelin's Ownable or AccessControl) to restrict these sensitive operations to authorized addresses only.

Status

Unresolved

Info

Unused Internal _contextSuffixLength Function

The Context.sol contract includes an internal virtual function _contextSuffixLength which returns 0. While this is part of the OpenZeppelin Context standard, it is not utilized or overridden in FourERC20.sol. In the context of FourERC20 being a standalone token, this function adds minor, unnecessary complexity without providing any specific functionality. (7.2 Code Security)I-01

Issue

The Context.sol contract includes an internal virtual function _contextSuffixLength which returns 0. While this is part of the OpenZeppelin Context standard, it is not utilized or overridden in FourERC20.sol. In the context of FourERC20 being a standalone token, this function adds minor, unnecessary complexity without providing any specific functionality. (7.2 Code Security)

Fix

Consider if _contextSuffixLength is truly needed or if a simpler Context base could be used if no meta-transaction features are planned. For standard ERC20, it's generally harmless but unused.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The FourERC20 contract implements a standard ERC-20 token using OpenZeppelin libraries. However, it critically lacks a constructor to initialize the token's name and symbol, and no public functions are provided to mint an initial supply or manage the total supply. This renders the token non-functional upon deployment, as it will have zero supply and uninitialized metadata. The core ERC-20 logic is robust due to OpenZeppelin's audited code, but the deployment and initialization strategy is fundamentally flawed.

Technical7/10Low risk

The contract leverages well-audited OpenZeppelin libraries for its core ERC-20 functionality (7.2 Code Security), providing a strong foundation for transfer and allowance mechanisms. However, a critical architectural flaw exists as the contract lacks a constructor to initialize essential token metadata like name and symbol, and no public minting mechanism is provided (7.1 Architecture). This means the token will be non-functional upon deployment, as _totalSupply will remain zero and metadata will be empty. The _init function is present but never called.

Governance6/10Medium risk

The economic model is severely impacted by the lack of an initial token supply and minting mechanism (7.4 Economic). Without a way to create tokens, the _totalSupply will remain zero, making the token economically useless. There are no specific governance mechanisms implemented (7.5 Governance), which is acceptable for a simple token, but the fundamental economic viability is compromised by the inability to create any tokens.

Upgrades9/10Low risk

The contract is not designed to be upgradeable (7.7 Upgrades), as indicated by is_proxy: false. This simplifies the deployment model by removing upgrade-related risks, but also means any discovered issues post-deployment cannot be fixed without a new deployment. Given the current critical functionality issues, this lack of upgradeability is a significant limitation.

Final RecommendationWhat to do about this score

It is strongly recommended to add a constructor to the FourERC20 contract to properly initialize the token's name and symbol.

Furthermore, a public minting function, potentially with robust access control, is required to create an initial supply of tokens and allow for future supply management, or a constructor-based initial mint. Without these critical changes, the token will be non-functional and unusable. Ensure all privileged functions, if added, are protected by appropriate access control mechanisms.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age1mo
Contract0x4c42…4444
Deployer0x8828…8828
Badge for your website
ANDY security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 30, 202621Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the ANDY contract address?

The ANDY contract on BNB Chain is 0x4c42e2217b4c28ab0df322373dd25e974a024444. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is ANDY a scam?

Quantum Audit's risk score for ANDY is 21/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is ANDY liquidity locked?

Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $132.8K.

Who holds ANDY?

As of Sep 4, 2026, the 10 largest holders own 91.7% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
ZygoSwapZSWAP · BNB Chain21LowSIRENBNB Chain21LowDogshitBNB Chain21LowWrapped TON CoinTONCOIN · BNB Chain21LowCao ZhenCZ · BNB Chain21LowIBSBNB Chain20Low

Would You Like a More Detailed Audit of ANDY?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page