Quantum Audit Logo

Is Avantis Safe?

On-chain security analysis — is it a scam or legit?

Avantis AVNT
0x696f…f4f1
Base Not verifiedLast checked 2d ago 2 audits on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The audit focused on the Token contract, an ERC20 token with blacklisting and cross-chain bridging capabilities. The contract utilizes OpenZeppelin's battle-tested libraries for ERC20 and Ownable2Step functionalities. Key features include an owner-controlled blacklist and functions for cross-chain minting/burning restricted to a predefined SuperchainTokenBridge address. The primary risks identified relate to the centralized control points (owner for blacklisting, and the critical dependency on the external bridge) and the inherent implications of a blacklisting mechanism. The owner is a multisig, which mitigates some centralization risks.

2 High1 Medium2 Informational
Volume 24h
$212.3K
Liquidity
$635.7K
Price
$0.1014
Token Age
1y
Top 10 Holders
86.7%

Security Findings

2 High1 Med2 Info
High

Centralized Blacklisting Power

H-01The `blacklistUpdate` function, protected by `onlyOwner`, allows the contract owner to blacklist any address. This grants significant centralized control, enabling the owner to prevent transfers to or from specific users, effectively freezing their tokens or preventing participation. While the owner is a multisig (3/6), a compromise of the multisig could lead to severe disruption and loss of user access to funds.
IssueThe `blacklistUpdate` function, protected by `onlyOwner`, allows the contract owner to blacklist any address. This grants significant centralized control, enabling the owner to prevent transfers to or from specific users, effectively freezing their tokens or preventing participation. While the owner is a multisig (3/6), a compromise of the multisig could lead to severe disruption and loss of user access to funds.
FixEnsure the multisig controlling the owner address is secured with the highest operational and key management standards. Implement robust internal procedures and controls for the use of the blacklisting function. Consider adding a timelock for critical owner actions like blacklisting to provide a window for detection and reaction.
StatusUnresolved
High

Critical Dependency on SuperchainTokenBridge

H-02The `crosschainMint` and `crosschainBurn` functions are exclusively callable by the `SUPERCHAIN_TOKEN_BRIDGE` address. This makes the token's supply and cross-chain functionality critically dependent on the security and integrity of this external bridge contract. A vulnerability or compromise in the `SUPERCHAIN_TOKEN_BRIDGE` could lead to unauthorized minting of tokens (inflation) or burning of user funds (deflation), severely impacting the token's economic stability.
IssueThe `crosschainMint` and `crosschainBurn` functions are exclusively callable by the `SUPERCHAIN_TOKEN_BRIDGE` address. This makes the token's supply and cross-chain functionality critically dependent on the security and integrity of this external bridge contract. A vulnerability or compromise in the `SUPERCHAIN_TOKEN_BRIDGE` could lead to unauthorized minting of tokens (inflation) or burning of user funds (deflation), severely impacting the token's economic stability.
FixThoroughly audit and continuously monitor the security of the `SUPERCHAIN_TOKEN_BRIDGE` contract. Implement robust monitoring systems to detect unusual activity related to cross-chain minting/burning. Consider a mechanism to pause cross-chain operations in an emergency, if feasible within the bridge's design.
StatusUnresolved
Medium

Potential for User Fund Freezing via Blacklist

M-01The blacklisting mechanism, while an intended feature, inherently carries the risk of freezing user funds. If an address holding tokens is blacklisted, those tokens become untransferable. This could occur due to an error, a malicious act by a compromised owner, or a policy decision, leading to a loss of access for affected users.
IssueThe blacklisting mechanism, while an intended feature, inherently carries the risk of freezing user funds. If an address holding tokens is blacklisted, those tokens become untransferable. This could occur due to an error, a malicious act by a compromised owner, or a policy decision, leading to a loss of access for affected users.
FixClearly communicate the blacklisting policy and its implications to all users. Establish a transparent process for blacklisting decisions and potential appeals. Consider implementing a 'grace period' or notification system before an address is fully blacklisted, if appropriate for the project's risk model.
StatusUnresolved
Info

No Upgradeability Mechanism

I-01The contract is implemented without an upgradeability pattern (e.g., proxies). This means that once deployed, the contract's logic cannot be modified. Any future bug fixes, security patches, or feature enhancements would require deploying a new contract and migrating all users and associated liquidity, which can be a complex and costly process.
IssueThe contract is implemented without an upgradeability pattern (e.g., proxies). This means that once deployed, the contract's logic cannot be modified. Any future bug fixes, security patches, or feature enhancements would require deploying a new contract and migrating all users and associated liquidity, which can be a complex and costly process.
FixAcknowledge the implications of non-upgradeability. For critical infrastructure, consider if an upgradeable design would be beneficial for long-term maintenance and adaptability. If not, ensure the current design is extremely robust and future-proof.
StatusUnresolved
Info

Hardcoded SuperchainTokenBridge Address

I-02The `SUPERCHAIN_TOKEN_BRIDGE` address is hardcoded as a `constant`. While this ensures immutability and prevents accidental changes, it also means that if the bridge contract ever needs to be replaced (e.g., due to a major upgrade, vulnerability, or change in infrastructure), the Token contract itself would need to be redeployed. This lack of flexibility could be a long-term operational constraint.
IssueThe `SUPERCHAIN_TOKEN_BRIDGE` address is hardcoded as a `constant`. While this ensures immutability and prevents accidental changes, it also means that if the bridge contract ever needs to be replaced (e.g., due to a major upgrade, vulnerability, or change in infrastructure), the Token contract itself would need to be redeployed. This lack of flexibility could be a long-term operational constraint.
FixEvaluate the long-term stability and upgrade path of the `SUPERCHAIN_TOKEN_BRIDGE`. If there's a foreseeable need for the bridge address to change, consider making it a configurable state variable, managed by the owner (preferably with a timelock), rather than a constant. If the bridge is truly immutable and part of the core chain infrastructure, then the constant is appropriate.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract (7.1 Architecture) is a standard ERC20 implementation enhanced with blacklisting and cross-chain functionality. It leverages OpenZeppelin's well-audited contracts (ERC20, Ownable2Step), contributing to robust code security (7.2 Code Security). The `_update` function is correctly overridden to enforce blacklist checks on transfers. However, the critical dependency on the `SUPERCHAIN_TOKEN_BRIDGE` for cross-chain operations introduces an external technical risk (7.6 External).

GovernanceHigh2/10

The contract exhibits significant centralization (7.3 Access Control) through the `onlyOwner` modifier for the `blacklistUpdate` function, granting the owner the power to freeze funds or prevent transfers for any address. While the owner is a 3/6 multisig, mitigating single-point-of-failure risk, this remains a powerful control. Economically (7.4 Economic), the token's integrity heavily relies on the security of the `SUPERCHAIN_TOKEN_BRIDGE`, as its compromise would allow arbitrary minting/burning. The blacklisting feature, while intended, carries an inherent risk of user fund freezing if misused.

UpgradesLow7/10

The contract is not designed with an upgrade mechanism (7.7 Upgrades). This means that any future bug fixes, feature enhancements, or changes to critical dependencies (like the `SUPERCHAIN_TOKEN_BRIDGE` address) would necessitate a complete redeployment of the token contract, which can be a complex and disruptive process for users and integrated protocols.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

86.7% in top 10
19.6% in wallets67.0% in contracts
Effective Concentration46.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$775.8K across 21 pairs
AerodromeUSDCanalysed$635.7K81.9%AerodromeUSDC$56.3K7.3%Uniswap v3WETH$31.4K4.0%Uniswap v3USDC$25.7K3.3%Uniswap v4USDC$19.5K2.5%Hydrex CLAMMUSDC$5.9K0.8%
Show 4 more pairsShow less
Uniswap v3USDC$4430.1%AerodromeWETH$3000.0%0x829c…4aEEWETH$1930.0%PancakeswapUSDC$1030.0%

The 11 remaining pairs hold $282 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder74.3%
Top-3 Unlocked96.2%

Key Addresses

11 addresses
Deployer
0xe4cc…797d
Unlocked LP Held By
0x3624…147c0x4150…97c50xb713…11d10x33ab…21fa0x9a88…bd090x13e0…63f70x83d9…452a0x808c…997f0xa3fb…50d90x1f61…b2b6

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

7 factors
  • Ownership NOT renounced — strong Multisig (3-of-6)
  • Top-10 concentration > 30% (86.7% total → 46.5% effective; 19.6% in EOAs, 67.0% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 74.3% (independent LP — depth risk, pool = 82% of DEX liquidity)
  • LP top3 unlocked holders = 96.2% (independent LP — depth risk, pool = 82% of DEX liquidity)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Avantis a scam?

Based on automated analysis, Avantis scores 65/100 (High Risk) on our risk scale. No honeypot was detected, but always verify independently before investing.

Is Avantis safe to buy?

Our scanner flagged a risk score of 65/100. Ownership has not been renounced, which is a risk factor. DYOR before purchasing any token.

Has Avantis been audited?

The contract has not been verified on-chain. Verification is not the same as a full security audit. Use Quantum Audit's free tool to run a deeper analysis of the contract code.

Related Audits

6 more on the record
Supergemma4-26b-multimodal (SUPERGEMMA)High RiskCoinbase Wrapped Staked ETH (CBETH)High RiskThe Innovation Game (TIG)High RiskMetronome Synth ETH (MSETH)High RiskOpenUSDT (OUSDT)High RiskBasemateHigh Risk

Would You Like a More Detailed Audit of Avantis?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit