Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Banana Safe?

BANANAEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical2/10Governance1/10Upgrades4/10Checks passed4 of 5Findings3 Critical · 2 High · 2 Medium · 1 Info8
SummaryAI Copilot

The Banana token contract implements an ERC-20 standard with significant deflationary and anti-whale mechanics, including transaction fees, max transaction limits, and automated liquidity provision.

Read the full analysis
What raised the score
  • Ownership not renounced — owner is an EOA
  • Top-10 concentration > 30%
  • 3 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 2 Medium finding(s) from audit
Exact factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Top-10 concentration > 30% (73.5% total → 46.0% effective; 27.6% in EOAs, 45.9% in contracts — moderate)
  • 3 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 2 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 44 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
45.9%Contracts27.6%Wallets26.5%Everyone else
45.9%Contracts27.6%Wallets26.5%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
73.5%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking45.9%
  • Walletsanonymous holders, free to sell27.6%
  • Everyone elsethe rest of the supply26.5%
Effective concentrationwhat the score reads46.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$3.14M across 2 pairs

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$3.14MShare of depth100.0%
LP Locked100.0% · Null Address, UNCX
Lock ExpiryExpired 335d ago
Unlocked LP held by
0xb3ac…68a00x826f…1e650xdc86…6d910x0000…8a900x1f2f…f3870xf450…231a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 Critical2 High2 Medium1 Info
Critical

Expired Liquidity Pool Lock Poses Rug Pull Risk

The provided prefill data indicates that the liquidity pool (LP) lock for the Uniswap V2 pair has expired. This means that the initial liquidity provider, likely the contract owner or an associated address, can withdraw all liquidity from the pool at any time. Such an action would lead to a complete collapse of the token's price, resulting in a total loss for token holders.C-01

Issue

The provided prefill data indicates that the liquidity pool (LP) lock for the Uniswap V2 pair has expired. This means that the initial liquidity provider, likely the contract owner or an associated address, can withdraw all liquidity from the pool at any time. Such an action would lead to a complete collapse of the token's price, resulting in a total loss for token holders.

Fix

Immediately re-lock the liquidity for a significant duration (e.g., 1-5 years) using a reputable locker service. Provide verifiable proof of the new lock to the community to restore trust and mitigate the rug pull risk.

Status

Unresolved

Critical

Lack of Slippage Protection in Automated Swaps

The swapAndLiquify function calls uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens with amountOutMin set to 0. This lack of slippage protection means that the contract is vulnerable to sandwich attacks and high price impact during automated token swaps. Malicious actors can front-run and back-run these transactions, extracting value and causing the contract to receive significantly less ETH than expected for the swapped tokens, ultimately harming the protocol's liquidity and value.C-02

Issue

The swapAndLiquify function calls uniswapV2Router.swapExactTokensForETHSupportingFeeOnTransferTokens with amountOutMin set to 0. This lack of slippage protection means that the contract is vulnerable to sandwich attacks and high price impact during automated token swaps. Malicious actors can front-run and back-run these transactions, extracting value and causing the contract to receive significantly less ETH than expected for the swapped tokens, ultimately harming the protocol's liquidity and value.

Fix

Implement a reasonable amountOutMin value in the swapExactTokensForETHSupportingFeeOnTransferTokens call within swapAndLiquify. This value should be calculated based on the expected ETH output and a tolerable slippage percentage, protecting the contract from excessive losses due to market manipulation.

Status

Unresolved

Critical

Excessive Owner Privileges and Centralization Risk

The owner() address has extensive control over critical contract parameters, including the ability to set buyTotalFees, sellTotalFees, revFee, treasuryFee, teamFee, maxTransactionAmount, maxWallet, swapTokensAtAmount, limitsInEffect, launched, and to add/remove addresses from fee and transaction limit exclusions. The owner can also update the uniswapV2Pair to an arbitrary address. This high degree of centralization presents a significant risk of malicious actions, such as draining funds, manipulating tokenomics, or disabling trading, leading to a potential rug pull or severe economic instability.C-03

Issue

The owner() address has extensive control over critical contract parameters, including the ability to set buyTotalFees, sellTotalFees, revFee, treasuryFee, teamFee, maxTransactionAmount, maxWallet, swapTokensAtAmount, limitsInEffect, launched, and to add/remove addresses from fee and transaction limit exclusions. The owner can also update the uniswapV2Pair to an arbitrary address. This high degree of centralization presents a significant risk of malicious actions, such as draining funds, manipulating tokenomics, or disabling trading, leading to a potential rug pull or severe economic instability.

Fix

Consider implementing a decentralized governance mechanism (e.g., a multi-signature wallet or a DAO) for critical parameter changes. If decentralization is not feasible, clearly document the owner's responsibilities and consider time-locks or multi-party approvals for highly sensitive functions to reduce single-point-of-failure risks. Renouncing ownership without a robust governance system is not recommended given the current level of control.

Status

Unresolved

High

High Transaction Fees Detrimental to Adoption

The contract implements extremely high transaction fees, with buyTotalFees and sellTotalFees both set to 40%. Such high fees are economically unsustainable for a cryptocurrency token and will severely deter legitimate trading activity. This can lead to low liquidity, reduced adoption, and a perception of the token as a speculative asset rather than a viable medium of exchange, ultimately harming its long-term value and stability.H-01

Issue

The contract implements extremely high transaction fees, with buyTotalFees and sellTotalFees both set to 40%. Such high fees are economically unsustainable for a cryptocurrency token and will severely deter legitimate trading activity. This can lead to low liquidity, reduced adoption, and a perception of the token as a speculative asset rather than a viable medium of exchange, ultimately harming its long-term value and stability.

Fix

Significantly reduce transaction fees to a more reasonable and competitive level (e.g., 1-10%). High fees often discourage trading and can lead to a 'dead' chart. A sustainable fee structure is crucial for fostering a healthy trading environment and encouraging adoption.

Status

Unresolved

High

Owner Can Change Uniswap Pair to Arbitrary Address

The updateUniswapV2Pair function allows the owner to set the uniswapV2Pair address to any arbitrary address. A malicious owner could point this to a controlled contract or a non-existent address, effectively disrupting the automated liquidity provision mechanism, preventing swaps, or even draining funds if the new address is a malicious contract designed to exploit interactions.H-02

Issue

The updateUniswapV2Pair function allows the owner to set the uniswapV2Pair address to any arbitrary address. A malicious owner could point this to a controlled contract or a non-existent address, effectively disrupting the automated liquidity provision mechanism, preventing swaps, or even draining funds if the new address is a malicious contract designed to exploit interactions.

Fix

Restrict the updateUniswapV2Pair function to only allow setting a new pair if it has been properly created and verified, or remove the ability to change the pair after initial deployment if the intention is for it to be immutable. If the functionality is necessary, consider adding a time-lock or multi-signature approval for such a critical change.

Status

Unresolved

Medium

Hardcoded External Contract Addresses

The contract hardcodes the addresses for IUniswapV2Router02 (0x7a25…488D) and WETH (0xC02a…6Cc2). While these are standard addresses on Ethereum mainnet, hardcoding them makes the contract less flexible. In the event of a router upgrade, a WETH contract change, or deployment to a different network with different addresses, the contract would need to be redeployed, which is not possible for a non-upgradeable contract.M-01

Issue

The contract hardcodes the addresses for IUniswapV2Router02 () and WETH (). While these are standard addresses on Ethereum mainnet, hardcoding them makes the contract less flexible. In the event of a router upgrade, a WETH contract change, or deployment to a different network with different addresses, the contract would need to be redeployed, which is not possible for a non-upgradeable contract.

Fix

For future contracts, consider making such critical external addresses configurable by the owner (with appropriate access controls and safeguards) or through a governance mechanism. For this deployed contract, this is a limitation that cannot be changed without redeployment.

Status

Unresolved

Medium

renounceOwnership Without Replacement Mechanism

The Ownable contract includes a renounceOwnership function, which, if called, sets the contract owner to address(0). Given the extensive owner privileges in the Banana contract (e.g., setting fees, limits, managing exclusions, updating the Uniswap pair), renouncing ownership without a robust, decentralized governance mechanism in place would render the contract unmanageable. This could prevent necessary parameter adjustments, bug fixes, or responses to unforeseen circumstances.M-02

Issue

The Ownable contract includes a renounceOwnership function, which, if called, sets the contract owner to address(0). Given the extensive owner privileges in the Banana contract (e.g., setting fees, limits, managing exclusions, updating the Uniswap pair), renouncing ownership without a robust, decentralized governance mechanism in place would render the contract unmanageable. This could prevent necessary parameter adjustments, bug fixes, or responses to unforeseen circumstances.

Fix

If the intention is to decentralize control, ensure a fully functional and tested governance system (e.g., a DAO or a multi-signature wallet) is in place and capable of managing all critical parameters before renounceOwnership is ever considered. Otherwise, the owner should retain control to manage the contract's parameters responsibly.

Status

Unresolved

Info

Unnecessary pragma experimental ABIEncoderV2;

The pragma experimental ABIEncoderV2; directive is included in the contract. ABIEncoderV2 is no longer experimental since Solidity version 0.8.0. While its presence is harmless, it is no longer necessary for Solidity 0.8.21 and can be removed for cleaner code.I-01

Issue

The pragma experimental ABIEncoderV2; directive is included in the contract. ABIEncoderV2 is no longer experimental since Solidity version 0.8.0. While its presence is harmless, it is no longer necessary for Solidity 0.8.21 and can be removed for cleaner code.

Fix

Remove the pragma experimental ABIEncoderV2; directive.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The Banana token contract implements an ERC-20 standard with significant deflationary and anti-whale mechanics, including transaction fees, max transaction limits, and automated liquidity provision. The audit identified critical centralization risks due to extensive owner privileges, an expired liquidity pool lock, and a lack of slippage protection in automated swaps. High transaction fees and the owner's ability to change the Uniswap pair also pose substantial economic and security risks. While basic reentrancy protection is present, the overall design grants the owner excessive control, making the protocol highly susceptible to malicious actions or economic instability.

Technical2/10High risk

The contract utilizes Solidity 0.8.21, benefiting from built-in overflow/underflow protection. It includes a swapping flag to prevent reentrancy during automated liquidity operations, addressing a common vulnerability (7.2 Code Security). However, a critical technical flaw exists in the swapAndLiquify function, which performs swaps with amountOutMin = 0, exposing the contract to severe slippage and sandwich attacks (7.2 Code Security). Additionally, hardcoded external contract addresses reduce flexibility (7.1 Architecture).

Governance1/10High risk

The economic model is highly centralized, with the owner possessing extensive control over critical parameters such as transaction fees, max transaction amounts, and wallet limits (7.3 Access Control, 7.4 Economic). A significant economic risk is the expired liquidity pool lock, which allows the owner to remove all liquidity, leading to a rug pull (7.4 Economic). The extremely high transaction fees (40% buy/sell) are economically unsustainable and likely to deter legitimate trading (7.4 Economic). The owner's ability to update the Uniswap pair to an arbitrary address introduces a severe governance risk (7.5 Governance).

Upgrades4/10Medium risk

The contract is not designed as an upgradeable proxy (7.7 Upgrades). Therefore, there are no upgrade-specific risks or considerations. Any changes to the contract logic would require a new deployment and migration of assets.

Final RecommendationWhat to do about this score

Address the critical centralization risks by implementing a robust, decentralized governance mechanism or by renouncing ownership after setting immutable, safe parameters.

Immediately re-lock the liquidity pool for a substantial period to protect investors from a rug pull. Implement proper slippage protection (amountOutMin > 0) in all automated swap functions to prevent value loss from sandwich attacks and high slippage. Re-evaluate the economic model, specifically the extremely high transaction fees, to ensure sustainability and attract legitimate users.

Contract & Record

1 audit on record
TypeVault, Router, Token
NetworkEthereum
Token age2y
Contract0x38e6…30b4
Deployer0x37aa…d66b
Badge for your website
Banana security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 16, 2026100Critical

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
SpaceX xStockSPCXX · Ethereum100CriticalPonsEthereum100CriticalGoldfishGGBR · Ethereum100CriticalAUSDEthereum100CriticalNVIDIA (Ondo Tokenized)NVDAON · Ethereum100CriticalRollbit CoinRLB · Ethereum100Critical

Would You Like a More Detailed Audit of Banana?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page