Quantum Audit Logo

Is ARK Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

ARK ARK
0xcae1…8b9d
BNB Chain Not verifiedLast checked 2d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

This audit covers a truncated Solidity source code snippet, identified as OpenZeppelin's AccessControl contract. The provided code implements a standard role-based access control mechanism. While the core OpenZeppelin implementation is robust and well-audited, the audit scope is limited by the incomplete source. The primary risks identified are related to the governance implications of the powerful DEFAULT_ADMIN_ROLE and general best practices for critical operations in systems utilizing such access control.

2 Low2 Informational
Volume 24h
$7.28M
Liquidity
$51.61M
Price
$5.1200
Token Age
11mo
Top 10 Holders
97.7%

Security Findings

2 Low2 Info
Low

Lack of Time-Locks for Critical Role Changes

L-01While `AccessControl` provides a robust mechanism for managing roles, it does not inherently include time-lock functionality for critical operations such as granting or revoking sensitive roles. For roles that control significant protocol parameters, funds, or upgradeability, immediate changes could be exploited if an admin key is compromised or a malicious actor gains control.
IssueWhile `AccessControl` provides a robust mechanism for managing roles, it does not inherently include time-lock functionality for critical operations such as granting or revoking sensitive roles. For roles that control significant protocol parameters, funds, or upgradeability, immediate changes could be exploited if an admin key is compromised or a malicious actor gains control.
FixFor any roles that have the ability to perform critical operations (e.g., modifying protocol fees, pausing contracts, or upgrading logic), consider implementing a time-lock mechanism on top of the `grantRole` and `revokeRole` functions. This would introduce a delay before changes take effect, allowing for community scrutiny or emergency intervention.
StatusUnresolved
Low

Absence of Emergency Pause Functionality

L-02The `AccessControl` contract itself does not include an emergency pause mechanism. In complex DeFi protocols, the ability to pause certain functionalities (e.g., deposits, withdrawals, trading) can be crucial to mitigate damage during an exploit, critical bug discovery, or market instability. Without such a mechanism, the protocol may be vulnerable to ongoing attacks or irreversible losses.
IssueThe `AccessControl` contract itself does not include an emergency pause mechanism. In complex DeFi protocols, the ability to pause certain functionalities (e.g., deposits, withdrawals, trading) can be crucial to mitigate damage during an exploit, critical bug discovery, or market instability. Without such a mechanism, the protocol may be vulnerable to ongoing attacks or irreversible losses.
FixConsider integrating an emergency pause mechanism (e.g., OpenZeppelin's `Pausable` module) into the contracts that inherit `AccessControl` and manage critical protocol operations. This pause functionality should be controlled by a specific, highly secured role (e.g., a multi-sig wallet) to prevent abuse.
StatusUnresolved
Info

Centralization Risk of DEFAULT_ADMIN_ROLE

I-01The `DEFAULT_ADMIN_ROLE` in the `AccessControl` contract holds significant power, as it can grant and revoke any other role, including itself. If this role is controlled by a single external owned account (EOA), it represents a single point of failure and a high centralization risk. A compromise of this EOA could lead to full control over the protocol's access management.
IssueThe `DEFAULT_ADMIN_ROLE` in the `AccessControl` contract holds significant power, as it can grant and revoke any other role, including itself. If this role is controlled by a single external owned account (EOA), it represents a single point of failure and a high centralization risk. A compromise of this EOA could lead to full control over the protocol's access management.
FixIt is strongly recommended that the `DEFAULT_ADMIN_ROLE` be assigned to a robust multi-signature wallet (e.g., Gnosis Safe) requiring multiple approvals for any transaction. This distributes control and significantly reduces the risk of a single point of compromise.
StatusUnresolved
Info

Incomplete Source Code Provided for Audit

I-02The provided source code snippet is a flattened version of OpenZeppelin's `AccessControl` and its dependencies, but it appears to be truncated. The audit was conducted based solely on the provided code, which may not represent the entire codebase of the 'ARK Protocol' or the specific contract being deployed. This limits the scope of the audit and prevents a comprehensive review of all potential interactions and custom logic.
IssueThe provided source code snippet is a flattened version of OpenZeppelin's `AccessControl` and its dependencies, but it appears to be truncated. The audit was conducted based solely on the provided code, which may not represent the entire codebase of the 'ARK Protocol' or the specific contract being deployed. This limits the scope of the audit and prevents a comprehensive review of all potential interactions and custom logic.
FixFor a complete security assessment, the full and complete source code of all relevant contracts, including any inheriting contracts or custom logic built on top of `AccessControl`, should be provided. This ensures all potential attack vectors and interactions can be thoroughly analyzed.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract utilizes OpenZeppelin's `AccessControl` module, which is a well-audited and widely adopted standard for implementing role-based access control (7.2 Code Security). This provides a robust and secure foundation for managing permissions within the protocol. The implementation correctly uses `bytes32` identifiers for roles and enforces admin role requirements for `grantRole` and `revokeRole` (7.3 Access Control). No custom logic or complex interactions were observed that would introduce new technical vulnerabilities.

GovernanceMedium5/10

The `AccessControl` pattern inherently introduces governance considerations, particularly concerning the `DEFAULT_ADMIN_ROLE` (7.5 Governance). This role possesses the power to grant and revoke any other role, including itself, making it a critical point of control. If this role is controlled by a single entity or an easily compromised EOA, it presents a significant centralization risk (7.4 Economic). For example, a compromised admin could grant themselves sensitive roles, leading to unauthorized asset control or protocol manipulation. Implementing multi-signature wallets for the `DEFAULT_ADMIN_ROLE` is crucial to mitigate this risk.

UpgradesMedium4/10

The provided contract is a standard `AccessControl` implementation and is not designed to be upgradeable (7.7 Upgrades). There are no proxy patterns (e.g., UUPS, Transparent) or upgrade-specific logic present in the code. This means the contract's logic is immutable once deployed, eliminating risks associated with upgradeability such as proxy misconfigurations or malicious upgrade implementations.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedPass
Not a ProxyPass

Holder Composition

97.7% in top 10
2.5% in wallets95.2% in contracts
Effective Concentration40.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$51.61M across 2 pairs
Pancakeswap v2USDTanalysed$51.61M100.0%Pancakeswap v2WBNB$70.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address

Key Addresses

9 addresses
Deployer
0x58e7…3386
Unlocked LP Held By
0xfb1f…75760x902e…f7920x89c8…a46a0x4127…88550x037c…643f0xca8f…d1f80x01e7…5d2d0x2511…88be

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

4 factors
  • Ownership NOT renounced (admin/mint authority retained)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (97.7% total → 40.6% effective; 2.5% in EOAs, 95.2% in contracts — moderate)
  • 2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
牛来Medium RiskSaturnMedium RiskMax Sister (LILY)Medium RiskXPIN Token (XPIN)Medium RiskTRADOORMedium RiskTutorial (TUT)Medium Risk

Would You Like a More Detailed Audit of ARK?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit