On-chain security analysis — is it a scam or legit?
PolygonThe protocol implements a centralized, upgradeable ERC-20 token with administrative controls for minting, blacklisting, and pausing.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 26, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xcf92…671a0x3b20…debe0x18bd…3c940x8c0b…4a240x933d…1f140x669a…92e00x099c…a6b30x0455…8a330x0e16…1abd0x8d8c…446eNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The mint(address,uint256) function allows authorized minters to create new tokens, which can dilute the value of existing holdings. This function is restricted to addresses configured by the MasterMinter.
Implement a strict minting cap or transition to a decentralized governance model to approve large minting events.
Unresolved
The blacklist and unBlacklist functions allow a privileged address to prevent specific users from transferring or selling their tokens. This creates a risk of censorship or permanent loss of access to funds for affected users.
Restrict the blacklisting capability to a multi-signature wallet or a time-locked governance process to prevent arbitrary or malicious freezing of user accounts.
Unresolved
The ten largest holders own 69.9% of supply. What remains: 64.6% in wallets, 5.2% in other contracts. 8,748 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Brazilian Digital (BRZ), market cap $51M, rank #436. 8,748 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $75K (DexScreener, all pools). 24h trading volume $389K (CoinGecko, all markets, daily snapshot). 24h trading volume $390K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $9.99 on 2023-10-29; the price is now 98.1026% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token designed to hold a fixed value (usually $1). Its safety rests on what backs it and on who can mint, freeze or pause it. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Fiat-backed Stablecoin. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: a timelock with a 24h delay. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $75K of DEX liquidity across 7 pools. Launch: 1140 days of market history.
Check what backs the peg and who controls supply: reserve attestations for an issuer-backed coin, collateral and governance for a protocol coin.
Acknowledged
The protocol implements a centralized, upgradeable ERC-20 token with administrative controls for minting, blacklisting, and pausing. While the architecture follows standard OpenZeppelin patterns, the high degree of centralization poses significant risks to token holders. The contract is managed via a Timelock controller, which mitigates immediate risks from malicious owner actions.
The contract utilizes standard OpenZeppelin upgradeable libraries, ensuring robust base functionality. 7.1 Architecture is modular, separating logic from storage via a Transparent Proxy pattern. 7.2 Code Security is high, with clear separation of concerns in 7.3 Access Control. 7.6 External dependencies are minimal and well-vetted.
7.4 Economic and 7.5 Governance risks are elevated due to centralized minting and blacklisting capabilities. The protocol relies on a Timelock for administrative changes, providing a safety buffer for users. However, the ability to arbitrarily mint tokens or freeze accounts remains a significant trust requirement for participants.
7.7 Upgrades are managed through a Transparent Proxy pattern controlled by a Timelock. This ensures that any logic changes are transparent and subject to a mandatory delay. 7.8 Operations are consistent with industry standards for upgradeable assets.
Users should be aware that the protocol is highly centralized, and trust is placed in the entities managing the minter, blacklister, and owner roles.
We recommend implementing a multi-signature wallet or a decentralized governance DAO to manage these privileged roles to reduce single-point-of-failure risks. Ensure that the Timelock delay is sufficient to allow users to exit positions if an undesirable upgrade or administrative action is proposed. Regularly monitor the activity of privileged addresses to ensure compliance with stated protocol policies.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The BRZ Token (BRZ) contract on Polygon is 0x4ed141110f6eeeaba9a1df36d8c26f684d2475dc. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for BRZ Token is 11/100 (Low risk) as of Oct 26, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 26, 2026). Total DEX liquidity: $74.7K.
As of Oct 26, 2026, the 10 largest holders own 69.9% of the supply across 8,748 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
