Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is ApeCoin Safe?

APEEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance2/10Upgrades6/10Checks passed3 of 5Findings2 Low · 2 Info4
SummaryAI Copilot

The SimpleToken contract is a basic ERC-20 token implementation, inheriting directly from OpenZeppelin's battle-tested ERC20 standard.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 66.2%
  • LP top3 unlocked holders = 98.3%
  • 2 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 30% (47.4% total → 38.1% effective; 31.9% in EOAs, 15.5% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 66.2% (independent LP — depth risk, pool = 73% of DEX liquidity)
  • LP top3 unlocked holders = 98.3% (independent LP — depth risk, pool = 73% of DEX liquidity)
  • 2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
15.5%Contracts31.9%Wallets52.6%Everyone else
15.5%Contracts31.9%Wallets52.6%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
47.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking15.5%
  • Walletsanonymous holders, free to sell31.9%
  • Everyone elsethe rest of the supply52.6%
Effective concentrationwhat the score reads38.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$494.9K across 8 pairs
Show 2 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$359.8KShare of depth72.7%
Top-1 Unlocked Holder66.2%
Top-3 Unlocked98.3%
Unlocked LP held by
0x14f0…54de0x9446…a0d40xb432…c1a00x8b30…adf30xf1cb…9e7e0xb0f9…d61e0x59df…c53a0x2394…37290x8990…d0350x036c…db14

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 Low2 Info
Low

Centralized Initial Token Supply

The SimpleToken contract's constructor mints the entire totalSupply_ to msg.sender. This means the deployer address holds 100% of the token supply immediately after deployment. This centralization creates a single point of failure for the token's distribution and control, as a compromise of the deployer's private key would put the entire token supply at risk. (7.3 Access Control, 7.4 Economic)L-01

Issue

The SimpleToken contract's constructor mints the entire totalSupply_ to msg.sender. This means the deployer address holds 100% of the token supply immediately after deployment. This centralization creates a single point of failure for the token's distribution and control, as a compromise of the deployer's private key would put the entire token supply at risk. (7.3 Access Control, 7.4 Economic)

Fix

While acceptable for a 'simple' token, for projects requiring broader distribution or enhanced security, consider implementing a more decentralized initial distribution mechanism. This could involve vesting contracts, airdrops, or a multi-signature wallet to hold the initial supply.

Status

Unresolved

Low

Immutability of Token Parameters and Supply

The SimpleToken contract sets its name, symbol, decimals, and total supply only during construction. There are no functions for further minting, burning (beyond standard ERC20 transfers), pausing transfers, or modifying any token parameters post-deployment. This design choice makes the token highly predictable and immutable but lacks flexibility for future adjustments, emergency measures, or supply management. (7.1 Architecture, 7.4 Economic)L-02

Issue

The SimpleToken contract sets its name, symbol, decimals, and total supply only during construction. There are no functions for further minting, burning (beyond standard ERC20 transfers), pausing transfers, or modifying any token parameters post-deployment. This design choice makes the token highly predictable and immutable but lacks flexibility for future adjustments, emergency measures, or supply management. (7.1 Architecture, 7.4 Economic)

Fix

Understand that this is a design choice for a 'simple' token. If future flexibility (e.g., ability to mint more tokens, implement a burn mechanism, or pause transfers) is desired, the contract would need to be redesigned to include such administrative functions, typically protected by an owner or governance mechanism.

Status

Unresolved

Info

Standard ERC-20 Implementation

The SimpleToken contract is a straightforward implementation of the ERC-20 standard, inheriting directly from OpenZeppelin's ERC20 contract. This adherence to a widely adopted and audited standard ensures compatibility with existing infrastructure and reduces the likelihood of common ERC-20 specific vulnerabilities. (7.1 Architecture)I-01

Issue

The SimpleToken contract is a straightforward implementation of the ERC-20 standard, inheriting directly from OpenZeppelin's ERC20 contract. This adherence to a widely adopted and audited standard ensures compatibility with existing infrastructure and reduces the likelihood of common ERC-20 specific vulnerabilities. (7.1 Architecture)

Fix

No recommendation needed. This is a strength of the implementation.

Status

Resolved

Info

Safe Use of Unchecked Blocks in OpenZeppelin ERC20

The inherited OpenZeppelin ERC20 contract correctly utilizes unchecked blocks for arithmetic operations (e.g., _balances[sender] = senderBalance - amount;) that are preceded by require statements ensuring the conditions for safe subtraction (e.g., require(senderBalance >= amount, ...);). This pattern is a best practice in Solidity 0.8+ for optimizing gas costs while maintaining safety against integer underflows. (7.2 Code Security)I-02

Issue

The inherited OpenZeppelin ERC20 contract correctly utilizes unchecked blocks for arithmetic operations (e.g., _balances[sender] = senderBalance - amount;) that are preceded by require statements ensuring the conditions for safe subtraction (e.g., require(senderBalance >= amount, ...);). This pattern is a best practice in Solidity 0.8+ for optimizing gas costs while maintaining safety against integer underflows. (7.2 Code Security)

Fix

No recommendation needed. This demonstrates good security practices within the inherited library.

Status

Resolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The SimpleToken contract is a basic ERC-20 token implementation, inheriting directly from OpenZeppelin's battle-tested ERC20 standard. It mints the entire initial supply to the deployer during construction. The contract exhibits a low overall risk due to its simplicity, minimal custom logic, and reliance on audited libraries. Key considerations include the centralization of initial token supply and the immutability of its parameters post-deployment.

Technical10/10Low risk

The technical architecture (7.1) is straightforward, extending the robust OpenZeppelin ERC20 contract. Code security (7.2) is high, benefiting from OpenZeppelin's audited implementation which mitigates common vulnerabilities like reentrancy and integer overflows, as seen with safe unchecked blocks following require checks in _transfer and _burn. The custom logic in SimpleToken is minimal, limited to the constructor, which reduces the attack surface. There are no complex external interactions (7.6) or intricate state transitions that could introduce new technical risks.

Governance2/10High risk

The economic model (7.4) of SimpleToken is very basic: a fixed supply minted entirely to the deployer. This design choice makes the token predictable but introduces a single point of failure if the deployer's private key is compromised (L-01). There are no governance mechanisms (7.5) or administrative roles beyond the initial deployment, meaning no functions for pausing, burning, or further minting. This immutability (L-02) ensures stability but removes flexibility for future adjustments or emergency responses, which could be a limitation depending on the project's long-term goals.

Upgrades6/10Medium risk

The SimpleToken contract is not designed to be upgradeable (7.7). It is deployed as a standard, immutable contract without any proxy patterns (e.g., UUPS, Transparent). This design choice eliminates all risks associated with upgrade mechanisms, such as proxy misconfigurations, storage collisions, or insecure upgrade paths. While it offers no flexibility for future modifications, it ensures the contract's logic remains fixed and predictable post-deployment.

Final RecommendationWhat to do about this score

For the SimpleToken contract, the primary recommendations focus on secure deployment practices and careful management of the initial token supply.

Ensure the deployer's private key is secured with robust measures, such as a hardware wallet or multi-signature setup, given that this address holds the entire token supply. Consider the implications of the token's immutability; if future features or administrative controls are desired, a more complex contract design or an upgradeable architecture would be necessary.

Contract & Record

1 audit on record
TypeSimpleToken
NetworkEthereum
Token age1y
Contract0x4d22…4381
Deployer0x295d…a195
Badge for your website
ApeCoin security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 16, 202630Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the APE contract address?

The ApeCoin (APE) contract on Ethereum is 0x4d224452801aced8b2f0aebe155379bb5d594381. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is ApeCoin a scam?

Quantum Audit's risk score for ApeCoin is 30/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is APE liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $494.9K.

Who holds APE?

As of Sep 4, 2026, the 10 largest holders own 47.4% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
wojakEthereum30LowBalancerBAL · Ethereum30LowCateEthereum30LowLinqAILNQ · Ethereum30LowLayerZeroZRO · Ethereum30LowVAIOT TokenVAI · Ethereum30Low

Would You Like a More Detailed Audit of ApeCoin?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page