On-chain security analysis — is it a scam or legit?
EthereumThe Aztec token contract is an ERC20 token with a centralized minting capability, allowing the owner to create an unlimited supply of tokens.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
Whether the LP tokens are locked could not be determined.
Aztec token contract includes a mint function that is restricted to the contract owner via the onlyOwner modifier. This allows the owner to mint an arbitrary and unlimited amount of new tokens at any time. This centralized control over the token supply introduces a critical economic risk, as it can lead to uncontrolled inflation, dilution of existing token holders' value, and potential for malicious manipulation of the token's market dynamics (7.4 Economic, 7.3 Access Control).C-01The Aztec token contract includes a mint function that is restricted to the contract owner via the onlyOwner modifier. This allows the owner to mint an arbitrary and unlimited amount of new tokens at any time. This centralized control over the token supply introduces a critical economic risk, as it can lead to uncontrolled inflation, dilution of existing token holders' value, and potential for malicious manipulation of the token's market dynamics (7.4 Economic, 7.3 Access Control).
Implement a robust governance mechanism (e.g., DAO, multi-signature wallet with a timelock) to control the minting function. Alternatively, cap the total supply, remove the minting capability after an initial distribution, or introduce a burning mechanism to balance minting. Clearly communicate the minting policy to token holders.
Unresolved
Pausable contract) to temporarily halt token transfers or other critical operations in case of an emergency, such as a discovered vulnerability or a major market event. While not strictly required for a basic ERC20, a pause function can be a valuable operational tool (7.8 Operations).L-01The contract does not include a pause mechanism (e.g., using OpenZeppelin's Pausable contract) to temporarily halt token transfers or other critical operations in case of an emergency, such as a discovered vulnerability or a major market event. While not strictly required for a basic ERC20, a pause function can be a valuable operational tool (7.8 Operations).
Consider integrating a pause mechanism, such as OpenZeppelin's Pausable contract, to provide an emergency stop functionality. This would allow the owner (or a designated role) to temporarily freeze token transfers or minting in unforeseen circumstances, mitigating potential damage.
Unresolved
Aztec contract heavily relies on well-audited and battle-tested OpenZeppelin contracts (ERC20, Ownable2Step, ERC20Permit). This significantly reduces the likelihood of low-level implementation bugs and enhances the overall security posture of the contract (7.2 Code Security, 7.1 Architecture).I-01The Aztec contract heavily relies on well-audited and battle-tested OpenZeppelin contracts (ERC20, Ownable2Step, ERC20Permit). This significantly reduces the likelihood of low-level implementation bugs and enhances the overall security posture of the contract (7.2 Code Security, 7.1 Architecture).
No specific recommendation. This is a positive architectural choice.
Resolved
Ownable2Step for ownership transfers. This pattern requires the new owner to explicitly accept ownership after it has been transferred by the current owner, preventing accidental loss of ownership due to typos or incorrect addresses (7.3 Access Control).I-02The contract utilizes OpenZeppelin's Ownable2Step for ownership transfers. This pattern requires the new owner to explicitly accept ownership after it has been transferred by the current owner, preventing accidental loss of ownership due to typos or incorrect addresses (7.3 Access Control).
No specific recommendation. This is a strong security practice.
Resolved
The Aztec token contract is an ERC20 token with a centralized minting capability, allowing the owner to create an unlimited supply of tokens. While the contract leverages battle-tested OpenZeppelin libraries for core functionalities and access control, the owner's ability to mint tokens presents a critical economic risk. The contract is not upgradeable, ensuring immutability of its current logic.
The contract leverages battle-tested OpenZeppelin libraries for ERC20, Ownable2Step, and ERC20Permit functionalities, significantly enhancing code security and reliability (7.2 Code Security). The implementation is minimal, primarily extending these libraries with a single mint function. The use of Ownable2Step for ownership transfers is a strong security practice, mitigating the risk of accidental ownership loss (7.3 Access Control). No complex custom logic is present that could introduce technical vulnerabilities like reentrancy or arithmetic errors.
The primary economic risk stems from the highly centralized control over token supply (7.4 Economic). The mint function, callable only by the contract owner, allows for arbitrary creation of new tokens, which can lead to inflation and dilution of existing token holders without external governance mechanisms (7.5 Governance). While this design provides flexibility for the owner, it introduces significant trust assumptions. The Ownable2Step pattern for ownership transfer is a positive aspect, providing a secure mechanism for changing the controlling entity.
The Aztec token contract is not designed to be upgradeable (7.7 Upgrades). This means its logic is immutable once deployed, providing certainty regarding its behavior. While immutability prevents future bug fixes or feature enhancements, it eliminates the risks associated with proxy patterns, such as upgradeability misconfigurations or malicious upgrade paths. Any changes to the token's core logic would require a new contract deployment and migration.
It is strongly recommended to implement robust governance mechanisms or a clear policy regarding the use of the centralized minting function to mitigate the significant economic risk of token inflation.
Consider implementing a timelock for critical owner actions or a multi-signature wallet for the owner address to enhance security and decentralization. If the intention is for a fixed supply, the mint function should be removed or made callable only once for an initial supply.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The AZTEC contract on Ethereum is 0xa27ec0006e59f245217ff08cd52a7e8b169e62d2. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for AZTEC is 71/100 (High risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
As of Sep 4, 2026, the 10 largest holders own 100.0% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
