Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Animecoin Safe?

ANIMEEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades6/10Checks passed5 of 7Findings1 High · 1 Medium · 1 Low · 1 Info4
SummaryAI Copilot

The Animecoin contract is an ERC20Permit token with owner-controlled functionality for registering the token on an Arbitrum L2 gateway.

Read the full analysis
What raised the score
  • Ownership not renounced — owner is an EOA
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Top-10 concentration > 30% (95.2% total → 44.7% effective; 10.9% in EOAs, 84.3% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 87% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 87% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 45 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
84.3%Contracts10.9%Wallets4.8%
84.3%Contracts10.9%4.8%
ContractsWalletsEveryone elseBubble area = share of supply
95.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking84.3%
  • Walletsanonymous holders, free to sell10.9%
  • Everyone elsethe rest of the supply4.8%
Effective concentrationwhat the score reads44.7%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$165.6K across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$143.9KShare of depth86.9%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x68ed…e4a0

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low1 Info
High

Missing ETH Withdrawal Mechanism for Owner

The registerTokenOnL2 function is payable and forwards valueForGateway and valueForRouter to external Arbitrum gateway contracts. If the msg.value sent to registerTokenOnL2 by the owner exceeds the sum of valueForGateway and valueForRouter, the excess ETH will remain in the Animecoin contract. There is no owner-controlled function to withdraw this trapped ETH, leading to a permanent loss of funds for the owner.H-01

Issue

The registerTokenOnL2 function is payable and forwards valueForGateway and valueForRouter to external Arbitrum gateway contracts. If the msg.value sent to registerTokenOnL2 by the owner exceeds the sum of valueForGateway and valueForRouter, the excess ETH will remain in the Animecoin contract. There is no owner-controlled function to withdraw this trapped ETH, leading to a permanent loss of funds for the owner.

Fix

Implement a dedicated withdrawETH function, restricted to the onlyOwner role, allowing the owner to recover any excess ETH sent to the contract. This function should transfer the contract's balance to a specified address.

Status

Unresolved

Medium

Unusual isArbitrumEnabled View Function Behavior

The isArbitrumEnabled view function is guarded by require(shouldRegisterGateway, "NOT_EXPECTED_CALL"). The shouldRegisterGateway flag is only set to true temporarily during the execution of the registerTokenOnL2 function. This means that isArbitrumEnabled() will almost always revert when called directly or by external systems outside of the specific L2 registration process, which is unexpected for a public view function and could cause integration issues or confusion.M-01

Issue

The isArbitrumEnabled view function is guarded by require(shouldRegisterGateway, "NOT_EXPECTED_CALL"). The shouldRegisterGateway flag is only set to true temporarily during the execution of the registerTokenOnL2 function. This means that isArbitrumEnabled() will almost always revert when called directly or by external systems outside of the specific L2 registration process, which is unexpected for a public view function and could cause integration issues or confusion.

Fix

Re-evaluate the necessity of the shouldRegisterGateway check within isArbitrumEnabled. If the intent is to only allow this function to be called during registration, this design is highly restrictive. Consider removing the require statement to allow the function to always return its intended value, or provide clear documentation on its intended usage and limitations.

Status

Unresolved

Low

Reliance on External Arbitrum Bridge Parameters

The registerTokenOnL2 function requires the owner to provide several complex parameters (maxSubmissionCostForCustomGateway, maxSubmissionCostForRouter, maxGasForCustomGateway, maxGasForRouter, gasPriceBid, valueForGateway, valueForRouter) for the Arbitrum bridge calls. Incorrectly calculated or provided values for these parameters could lead to failed L2 registration transactions, wasted gas, or trapped funds if value is too high and not fully consumed (as noted in H-01). This places a significant operational burden on the owner.L-01

Issue

The registerTokenOnL2 function requires the owner to provide several complex parameters (maxSubmissionCostForCustomGateway, maxSubmissionCostForRouter, maxGasForCustomGateway, maxGasForRouter, gasPriceBid, valueForGateway, valueForRouter) for the Arbitrum bridge calls. Incorrectly calculated or provided values for these parameters could lead to failed L2 registration transactions, wasted gas, or trapped funds if value is too high and not fully consumed (as noted in H-01). This places a significant operational burden on the owner.

Fix

Provide comprehensive documentation and clear guidelines for the owner on how to correctly calculate and provide these Arbitrum-specific parameters. Consider adding sanity checks within the contract, if feasible, to validate parameter ranges or relationships, although this might be complex given the dynamic nature of gas prices and submission costs.

Status

Unresolved

Info

Hardcoded Arbitrum Enabled Return Value

The isArbitrumEnabled function returns uint8(0xb1). While 0xb1 is a specific and known constant used by Arbitrum for custom tokens, its direct hardcoding as a magic number without an explicit constant definition or comment can reduce code readability and maintainability. Future changes to Arbitrum's protocol might require updating this value, which would be less clear without a named constant.I-01

Issue

The isArbitrumEnabled function returns uint8(0xb1). While 0xb1 is a specific and known constant used by Arbitrum for custom tokens, its direct hardcoding as a magic number without an explicit constant definition or comment can reduce code readability and maintainability. Future changes to Arbitrum's protocol might require updating this value, which would be less clear without a named constant.

Fix

Define 0xb1 as a named constant (e.g., uint8 public constant ARBITRUM_ENABLED_VALUE = 0xb1;) and use this constant in the isArbitrumEnabled function. This improves readability and makes the code easier to understand and maintain.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The Animecoin contract is an ERC20Permit token with owner-controlled functionality for registering the token on an Arbitrum L2 gateway. The audit identified a high-severity issue regarding potential trapped ETH, a medium-severity issue concerning an unusual view function behavior, and several minor issues. The contract's core ERC20 functionality is robust due to OpenZeppelin inheritance, but specific custom logic introduces notable risks.

Technical8/10Low risk

The contract utilizes standard OpenZeppelin ERC20Permit and Ownable implementations, providing a solid foundation for token functionality (7.2 Code Security). The architecture integrates with Arbitrum L1/L2 gateways for token registration, demonstrating a clear purpose (7.1 Architecture). However, a high-severity issue was identified where excess ETH sent during the registerTokenOnL2 call can become permanently trapped in the contract due to a missing withdrawal mechanism (7.4 Economic, 7.8 Operations). Additionally, the isArbitrumEnabled view function's restrictive access control (7.3 Access Control) could lead to unexpected reverts for external callers.

Governance1/10High risk

The contract employs a simple Ownable access control model, granting the deployer exclusive rights to critical functions like registerTokenOnL2 (7.5 Governance). This centralized control is appropriate for a token registration mechanism. Economically, a significant risk exists where the owner could inadvertently trap ETH in the contract if they overpay for L2 registration (7.4 Economic), as there is no mechanism to recover these funds. The reliance on the owner to correctly provide complex parameters for external bridge calls also introduces operational risk (7.8 Operations).

Upgrades6/10Medium risk

The Animecoin contract is not designed with an upgradeability pattern (7.7 Upgrades). This means its logic is immutable once deployed, eliminating risks associated with proxy implementation, upgradeability proxies, or beacon proxies. Any future changes would require a new contract deployment and migration of assets.

Final RecommendationWhat to do about this score

It is strongly recommended to implement a mechanism for the owner to withdraw excess ETH from the contract to prevent potential loss of funds.

The behavior of the isArbitrumEnabled function should be reviewed to ensure it aligns with expected external integration patterns, potentially by removing the restrictive require statement or providing clear documentation. Furthermore, the owner should exercise extreme caution when calling registerTokenOnL2, ensuring all gas and value parameters are precisely calculated to avoid transaction failures or trapping funds.

Contract & Record

1 audit on record
TypeRouter, Token
NetworkEthereum
Token age1y
Contract0x4dc2…c277
Deployer0xf915…e8f3
Badge for your website
Animecoin security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 31, 202658Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the ANIME contract address?

The Animecoin (ANIME) contract on Ethereum is 0x4dc26fc5854e7648a064a4abd590bbe71724c277. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Animecoin a scam?

Quantum Audit's risk score for Animecoin is 58/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is ANIME liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $165.6K.

Who holds ANIME?

As of Sep 4, 2026, the 10 largest holders own 95.2% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Tether GoldXAUT · Ethereum58MediumMatrixMTX · Ethereum58MediumCentrifugeCFG · Ethereum58MediumChainflipFLIP · Ethereum58MediumAPI3Ethereum58MediumRova ProtocolROVA · Ethereum58Medium

Would You Like a More Detailed Audit of Animecoin?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page