On-chain security analysis — is it a scam or legit?
BNB ChainThe FourERC20 contract is an incomplete implementation of an ERC-20 token, lacking essential core functionality such as balance updates, token minting, and burning.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
_update function)_update internal virtual function, which is fundamental for all balance modifications (minting, burning, transferring), is not implemented in the FourERC20 contract. This omission renders the entire ERC-20 contract non-functional, as no tokens can be created, moved between accounts, or destroyed. Any attempt to call functions like transfer, transferFrom, _mint, or _burn will fail at runtime.C-01The _update internal virtual function, which is fundamental for all balance modifications (minting, burning, transferring), is not implemented in the FourERC20 contract. This omission renders the entire ERC-20 contract non-functional, as no tokens can be created, moved between accounts, or destroyed. Any attempt to call functions like transfer, transferFrom, _mint, or _burn will fail at runtime.
Implement the _update internal virtual function to handle the actual balance changes for from and to addresses, including checks for zero addresses and sufficient balances. This is the foundational logic for all token movements.
Unresolved
_init internal function, responsible for setting the token's _name and _symbol, is not called within the FourERC20 contract. Consequently, the name() and symbol() public view functions will return empty strings. This leads to poor user experience, potential display issues in wallets and explorers, and integration problems with exchanges or other DeFi protocols that rely on this metadata.H-01The _init internal function, responsible for setting the token's _name and _symbol, is not called within the FourERC20 contract. Consequently, the name() and symbol() public view functions will return empty strings. This leads to poor user experience, potential display issues in wallets and explorers, and integration problems with exchanges or other DeFi protocols that rely on this metadata.
Ensure that the _init function is called in the constructor of a derived contract, passing the desired name_ and symbol_ values. This will properly initialize the token's metadata upon deployment.
Unresolved
_mint internal virtual function, which is responsible for increasing the total supply and an account's balance, lacks a concrete implementation. Without this, no new tokens can be introduced into circulation, preventing the token from having any initial supply or dynamic supply management. This issue is a direct consequence of the unimplemented _update function.H-02The _mint internal virtual function, which is responsible for increasing the total supply and an account's balance, lacks a concrete implementation. Without this, no new tokens can be introduced into circulation, preventing the token from having any initial supply or dynamic supply management. This issue is a direct consequence of the unimplemented _update function.
Implement the _mint function, which should internally call the _update function (once _update is implemented) to correctly adjust the _totalSupply and the recipient's balance. Consider adding access control to the public-facing minting function in a derived contract.
Unresolved
_burn internal virtual function, which is responsible for decreasing the total supply and an account's balance, is not implemented. This prevents any tokens from being removed from circulation, which can be necessary for various tokenomics models or to recover from errors. This issue is also a direct consequence of the unimplemented _update function.H-03Similar to minting, the _burn internal virtual function, which is responsible for decreasing the total supply and an account's balance, is not implemented. This prevents any tokens from being removed from circulation, which can be necessary for various tokenomics models or to recover from errors. This issue is also a direct consequence of the unimplemented _update function.
Implement the _burn function, which should internally call the _update function (once _update is implemented) to correctly adjust the _totalSupply and the sender's balance. Ensure proper checks, such as requiring sufficient balance, are in place.
Unresolved
The FourERC20 contract is an incomplete implementation of an ERC-20 token, lacking essential core functionality such as balance updates, token minting, and burning. While it leverages OpenZeppelin's robust base for standard ERC-20 interfaces, its current state renders it non-functional as a standalone token. Critical issues prevent any token supply management or transfers, making the contract unusable.
The contract utilizes OpenZeppelin's Context, IERC20, and IERC20Metadata components, providing a structured foundation (7.2 Code Security). However, the FourERC20 contract is an incomplete implementation, critically missing the concrete implementation of the _update internal virtual function, which is essential for all balance modifications (7.1 Architecture). This directly prevents token minting, burning, and transfers. Additionally, the token's name and symbol are not initialized, leading to empty metadata (7.8 Operations).
The economic model is severely impacted as the token is non-functional; no tokens can be minted, transferred, or burned, rendering it without any intrinsic value or utility (7.4 Economic). This prevents any form of economic activity or value accrual. The contract does not include any specific governance mechanisms (7.5 Governance).
The provided contract is a standard, non-upgradeable implementation and does not incorporate any proxy patterns (7.7 Upgrades). Therefore, direct upgrade risks are not applicable. Any future modifications would necessitate a new contract deployment and a migration process.
The FourERC20 contract requires substantial development to become a functional ERC-20 token.
It is critical to implement the _update internal virtual function to enable all balance-modifying operations (minting, burning, transfers). Ensure the _init function is called within a constructor of a derived contract to properly set the token's name and symbol. Consider using a complete OpenZeppelin ERC20 implementation (e.g., ERC20PresetMinterPauser) or a fully custom, audited implementation if specific functionalities are required.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Brok contract on BNB Chain is 0xcedfec92cdda4f49541872543c18e97c587a4444. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Brok is 48/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $8.0K.
As of Sep 4, 2026, the 10 largest holders own 86.2% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
