Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is B Safe?

BNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance10/10Upgrades10/10Checks passed5 of 5Findings1 Low · 2 Info3
SummaryAI Copilot

The FourERC20 contract implements a standard ERC-20 token, largely based on OpenZeppelin Contracts v4.9.4. The provided code snippet is truncated, specifically for the core _transfer function, which limits a full security assessment of the token's fundamental transfer logic.

Read the full analysis
What raised the score
  • 1 Low finding(s) from audit
Exact factors
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 45 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
2.5%10.0%Wallets87.5%Everyone else
10.0%87.5%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
12.5%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking2.5%
  • Walletsanonymous holders, free to sell10.0%
  • Everyone elsethe rest of the supply87.5%
Effective concentrationwhat the score reads11.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$3.95M across 5 pairs

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$2.19MShare of depth55.6%
LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address
Unlocked LP held by
0x8e4d…d6140xf4da…bbec0x873f…46bb0x80d8…4ae90x28e2…e9df

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low2 Info
Low

Incomplete Source Code for Core Logic

The provided source code for the FourERC20.sol contract is truncated, specifically within the _transfer internal function. This prevents a full and definitive security assessment of the token's fundamental transfer mechanism, including checks for zero addresses, sufficient balances, and event emissions (7.2 Code Security). While the contract is based on OpenZeppelin, which implies robust implementations, the absence of the complete code means these critical internal operations could not be fully verified.L-01

Issue

The provided source code for the FourERC20.sol contract is truncated, specifically within the _transfer internal function. This prevents a full and definitive security assessment of the token's fundamental transfer mechanism, including checks for zero addresses, sufficient balances, and event emissions (7.2 Code Security). While the contract is based on OpenZeppelin, which implies robust implementations, the absence of the complete code means these critical internal operations could not be fully verified.

Fix

Provide the complete and untruncated source code for all contracts, especially for core internal functions like _transfer, _mint, and _burn, to allow for a comprehensive security audit and verification of all logic and checks.

Status

Unresolved

Info

Missing Public Mint/Burn Functionality

The FourERC20 contract, as a base ERC-20 implementation, does not expose public _mint or _burn functions. This means that the token's total supply (_totalSupply) is fixed at deployment and can only be modified by the internal _transfer function, or if a derived contract implements and exposes minting/burning capabilities (7.4 Economic). This is a design choice and not a vulnerability, but it's important for understanding the token's supply dynamics.I-01

Issue

The FourERC20 contract, as a base ERC-20 implementation, does not expose public _mint or _burn functions. This means that the token's total supply (_totalSupply) is fixed at deployment and can only be modified by the internal _transfer function, or if a derived contract implements and exposes minting/burning capabilities (7.4 Economic). This is a design choice and not a vulnerability, but it's important for understanding the token's supply dynamics.

Fix

If a variable token supply is desired, ensure that any derived contract implementing minting or burning functions includes appropriate access control (e.g., Ownable, AccessControl) and limits on who can call these functions and under what conditions. Clearly document the token's supply mechanism.

Status

Unresolved

Info

Internal _init Function Requires Constructor Call

The _init(string memory name_, string memory symbol_) function, responsible for setting the token's name and symbol, is declared as internal. This means it must be explicitly called within the constructor of the FourERC20 contract itself or a contract that inherits from it (7.1 Architecture). If FourERC20 is deployed directly without a constructor calling _init, the name() and symbol() functions will return empty strings, potentially leading to issues with token display and integration in wallets or exchanges.I-02

Issue

The _init(string memory name_, string memory symbol_) function, responsible for setting the token's name and symbol, is declared as internal. This means it must be explicitly called within the constructor of the FourERC20 contract itself or a contract that inherits from it (7.1 Architecture). If FourERC20 is deployed directly without a constructor calling _init, the name() and symbol() functions will return empty strings, potentially leading to issues with token display and integration in wallets or exchanges.

Fix

Ensure that the _init function is called in the constructor of the contract that is deployed to set the desired token name and symbol. For example: constructor() { _init("MyToken", "MTK"); }

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The FourERC20 contract implements a standard ERC-20 token, largely based on OpenZeppelin Contracts v4.9.4. The provided code snippet is truncated, specifically for the core _transfer function, which limits a full security assessment of the token's fundamental transfer logic. The contract is simple, lacking complex economic models, governance, or upgradeability features, which inherently reduces certain risk vectors. Key areas of review included architecture, code security, and access control, with a notable limitation due to incomplete source code.

Technical10/10Low risk

The contract leverages OpenZeppelin's battle-tested ERC-20 implementation, which provides a strong foundation for code security (7.2 Code Security). Standard functions like transfer, approve, and transferFrom are present, and the decreaseAllowance function correctly uses an unchecked block after a safety check, preventing underflow. Access control (7.3 Access Control) is minimal, as expected for a basic token, relying on _msgSender() for standard operations. However, the core _transfer function is truncated in the provided source, preventing a complete review of its internal logic and checks (7.1 Architecture, 7.2 Code Security).

Governance10/10Low risk

The FourERC20 token is a straightforward ERC-20 implementation without any complex economic models, staking mechanisms, or fee structures (7.4 Economic). This simplicity inherently reduces economic attack vectors. There are no explicit governance mechanisms (7.5 Governance) built into this base contract, meaning control over the token's core parameters (beyond initial deployment) is absent. The token's supply mechanism is not fully exposed in this base contract, implying a fixed supply unless a derived contract implements minting/burning functions.

Upgrades10/10Low risk

The FourERC20 contract is not designed with any upgradeability patterns (e.g., UUPS, Transparent, Beacon proxies) (7.7 Upgrades). This means the contract is immutable once deployed, eliminating risks associated with upgrade logic, proxy administration, or storage collisions. Any future changes would require a new deployment and migration of assets, which is a known characteristic for non-upgradeable contracts.

Final RecommendationWhat to do about this score

It is strongly recommended to provide the complete source code for all contracts, especially core logic like _transfer, to enable a comprehensive security audit.

If this token is intended to be part of a larger system or to have additional features (e.g., minting, burning, pausing, access control), those functionalities should be implemented in derived contracts and undergo a separate, thorough security review. Ensure that the _init function is correctly called in the constructor of the deployed contract to set the token's name and symbol as intended.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age1y
Contract0x6bdc…4444
Deployer0x6f0a…a290
Badge for your website
B security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Jul 23, 20260Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the B contract address?

The B contract on BNB Chain is 0x6bdcce4a559076e37755a78ce0c06214e59e4444. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is B a scam?

Quantum Audit's risk score for B is 0/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is B liquidity locked?

Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $3.95M.

Who holds B?

As of Sep 4, 2026, the 10 largest holders own 12.5% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
TCryptochicksTCC · BNB Chain0Low币安人生BNB Chain0LowSKYAIBNB Chain0LowDOYRBNB Chain0LowCREPEBNB Chain0Low4BNB Chain0Low

Would You Like a More Detailed Audit of B?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page