On-chain security analysis — is it a scam or legit?
EthereumThe ApusClubToken contract is a standard ERC20 token implementation, leveraging battle-tested OpenZeppelin libraries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0xb432…c1a00xc10a…59210xa49d…ef860xb3ac…68a00x826f…1e650xf385…5f850x918a…d84d0x0000…8a900x1f2f…f387A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.
msg.sender) in the constructor, establishing a highly centralized initial distribution (7.4 Economic). Additionally, the Ownable pattern grants the deployer exclusive control over the contract's ownership via transferOwnership (7.3 Access Control, 7.5 Governance), which could be a single point of failure if the owner's key is compromised. While renounceOwnership is available, it is not enforced, leaving the decision to the owner.L-01The entire token supply is minted to the deployer (msg.sender) in the constructor, establishing a highly centralized initial distribution (7.4 Economic). Additionally, the Ownable pattern grants the deployer exclusive control over the contract's ownership via transferOwnership (7.3 Access Control, 7.5 Governance), which could be a single point of failure if the owner's key is compromised. While renounceOwnership is available, it is not enforced, leaving the decision to the owner.
Consider renouncing ownership after all necessary administrative tasks are completed to enhance decentralization. If ownership is retained, implement robust security practices for the owner's private key (e.g., multi-signature wallet, hardware security module). Clearly communicate the initial distribution and ownership model to the community.
Unresolved
The contract leverages well-audited and widely adopted OpenZeppelin ERC20 and Ownable implementations. This significantly reduces the risk of common vulnerabilities associated with custom or less-tested code (7.2 Code Security). The use of standard libraries contributes to the overall robustness and security posture of the contract.
No action required. Continue to monitor OpenZeppelin security advisories for any updates to the base contracts.
Unresolved
ApusClubToken is fixed at 420,690,000,000 * 10**18 upon deployment and cannot be altered thereafter. There are no minting or burning functions available to the owner or any other entity post-initialization (7.4 Economic). This design provides predictability regarding token inflation/deflation, as the supply is immutable.I-02The total supply of ApusClubToken is fixed at 420,690,000,000 * 10**18 upon deployment and cannot be altered thereafter. There are no minting or burning functions available to the owner or any other entity post-initialization (7.4 Economic). This design provides predictability regarding token inflation/deflation, as the supply is immutable.
No action required. This is a design choice. Ensure this fixed supply model aligns with the project's long-term economic strategy and is clearly communicated to token holders.
Unresolved
The contract does not include any emergency control mechanisms such as pausing transfers or blacklisting malicious addresses. While this enhances decentralization by preventing arbitrary intervention, it also means there is no way to stop transfers in the event of a major exploit, unforeseen market manipulation, or other critical circumstances (7.8 Operations).
No action required. This is a design choice that prioritizes immutability and censorship resistance over centralized emergency response capabilities. Project stakeholders should be aware of this trade-off.
Unresolved
The ApusClubToken contract is a standard ERC20 token implementation, leveraging battle-tested OpenZeppelin libraries. The audit identified no critical or high-severity technical vulnerabilities. The primary considerations revolve around the centralized initial token distribution and ownership model, which are common for new token launches.
The ApusClubToken contract is built upon battle-tested OpenZeppelin ERC20 and Ownable implementations, significantly reducing the risk of common vulnerabilities (7.2 Code Security). The contract's custom logic is minimal, primarily involving the constructor's initial token mint. Solidity 0.8.20+ inherently prevents integer overflows/underflows, and unchecked blocks are used appropriately for gas optimization (e.g., in _update for balance adjustments). No reentrancy vectors were identified due to the absence of complex external interactions (7.1 Architecture). Access control is managed by the Ownable pattern, restricting administrative functions to the contract owner (7.3 Access Control).
The Ownable contract provides clear access control for administrative functions like transferOwnership and renounceOwnership, allowing the owner to manage contract control (7.5 Governance). The renounceOwnership function offers a path towards decentralization of administrative control post-deployment. However, the entire token supply is minted to the deployer in the constructor, leading to a highly centralized initial distribution (7.4 Economic). This centralization means the owner holds significant influence over the token's market dynamics and could be a single point of failure if the owner's key is compromised.
The ApusClubToken contract is not designed to be upgradeable, which eliminates the complexities and potential risks associated with upgrade mechanisms (7.7 Upgrades). This provides immutability and predictability for users, as the contract's logic cannot be altered post-deployment. As a non-upgradeable contract, any discovered vulnerabilities or desired feature changes would necessitate a redeployment and migration, which can be costly and disruptive for the community.
It is recommended that the contract owner carefully consider the implications of centralized ownership and, if aligned with the project's long-term vision, renounce ownership after ensuring all necessary administrative tasks are complete.
This action would enhance decentralization and reduce the single point of failure risk. Additionally, transparent communication with the community regarding the initial token distribution and the contract's immutable nature is advised to manage expectations and foster trust.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Apu Apustaja (APU) contract on Ethereum is 0x594daad7d77592a2b97b725a7ad59d7e188b5bfa. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Apu Apustaja is 0/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $975.6K.
As of Sep 4, 2026, the 10 largest holders own 42.4% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
