On-chain security analysis — is it a scam or legit?
BNB ChainThe BTCB Token contract is a standard BEP20 implementation with an Ownable access control pattern.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The 20 remaining pairs hold $3.17M between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x556b…d59e0x3254…0cab0xec08…40530x1c71…c5340xc262…8ab90xfd93…1c3e0xf8bb…17ab0x0c37…88780x11b5…1f8f0x51d1…093aNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
mint function, callable only by the contract owner, allows for the creation of an arbitrary amount of new tokens. This centralized control over the token supply introduces a significant economic risk (7.4 Economic) as the owner can unilaterally inflate the supply, potentially diluting the value for existing token holders without any checks or balances (7.3 Access Control).H-01The mint function, callable only by the contract owner, allows for the creation of an arbitrary amount of new tokens. This centralized control over the token supply introduces a significant economic risk (7.4 Economic) as the owner can unilaterally inflate the supply, potentially diluting the value for existing token holders without any checks or balances (7.3 Access Control).
Consider removing the mint function if a fixed supply is desired. If minting is a necessary feature, implement a robust governance mechanism (e.g., a multi-signature wallet or a DAO) to control minting operations, requiring multiple approvals or community consensus for any supply increases.
Unresolved
mint and transferOwnership, or the contract could become unmanageable (7.3 Access Control, 7.8 Operations).M-01The contract's ownership is controlled by a single Externally Owned Account (EOA). If this EOA's private key is compromised, lost, or becomes inaccessible, an attacker could gain full control over critical functions like mint and transferOwnership, or the contract could become unmanageable (7.3 Access Control, 7.8 Operations).
Transfer ownership from the current EOA to a multi-signature wallet (e.g., Gnosis Safe) to distribute control and require multiple approvals for sensitive operations, significantly reducing the risk of a single point of failure.
Unresolved
SafeMath is used to mitigate integer overflows/underflows, newer compiler versions (e.g., 0.8.x) include built-in overflow checks by default, offer better gas optimizations, and incorporate various security improvements and bug fixes (7.2 Code Security).I-01The contract is compiled with Solidity version 0.5.16. While SafeMath is used to mitigate integer overflows/underflows, newer compiler versions (e.g., 0.8.x) include built-in overflow checks by default, offer better gas optimizations, and incorporate various security improvements and bug fixes (7.2 Code Security).
Consider upgrading to a more recent and actively maintained Solidity compiler version (e.g., 0.8.x) for future deployments or contract iterations to benefit from enhanced security features and optimizations. Ensure thorough testing if upgrading.
Unresolved
approve Front-Running Riskapprove function is susceptible to a known ERC-20 front-running vulnerability. If a user approves an amount, and then approves a different amount without first setting the allowance to zero, a malicious actor could front-run the second transaction to spend the original allowance, and then spend the new allowance, effectively spending twice (7.2 Code Security). While increaseAllowance and decreaseAllowance functions are provided to mitigate this, the base approve function still carries this risk.I-02The approve function is susceptible to a known ERC-20 front-running vulnerability. If a user approves an amount, and then approves a different amount without first setting the allowance to zero, a malicious actor could front-run the second transaction to spend the original allowance, and then spend the new allowance, effectively spending twice (7.2 Code Security). While increaseAllowance and decreaseAllowance functions are provided to mitigate this, the base approve function still carries this risk.
Educate users to utilize increaseAllowance and decreaseAllowance instead of directly calling approve when modifying an existing allowance. Alternatively, consider implementing a 'zero-then-approve' pattern within the approve function itself, though this adds an extra transaction for users.
Unresolved
The BTCB Token contract is a standard BEP20 implementation with an Ownable access control pattern. It utilizes SafeMath for arithmetic operations, mitigating common integer overflow/underflow vulnerabilities. However, the contract features a centralized minting capability controlled by the owner, posing a significant economic risk. Additionally, ownership is managed by a single EOA, creating a single point of failure.
The contract demonstrates good technical practices, including the use of the SafeMath library (7.2 Code Security) to prevent integer overflows/underflows. It adheres to the BEP20 standard, providing expected token functionalities. Minor technical observations include the use of an older Solidity compiler version (0.5.16) and the inherent front-running risk associated with the standard ERC-20 approve function, though increaseAllowance and decreaseAllowance are provided (7.2 Code Security).
A significant economic risk (7.4 Economic) is the owner's ability to mint an unlimited supply of new tokens via the mint function (7.3 Access Control). This centralized control can lead to token dilution and value depreciation. Furthermore, the contract's ownership is held by a single Externally Owned Account (EOA), which presents a single point of failure (7.8 Operations). The initial token supply is also entirely minted to the deployer, centralizing initial distribution.
The contract is not designed with an upgradeability pattern (7.7 Upgrades), meaning its code is immutable once deployed. This eliminates upgrade-related risks but also prevents future bug fixes or feature enhancements without a new deployment.
It is strongly recommended to address the centralized minting capability by either removing the mint function entirely to establish a fixed supply, or by implementing a robust governance mechanism (e.g., a multi-signature wallet or DAO) to control minting, ensuring community oversight and transparency.
Additionally, the contract's ownership should be transferred from a single EOA to a multi-signature wallet to enhance security and mitigate the risk of a single point of failure.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The BTCB Token (BTCB) contract on BNB Chain is 0x7130d2a12b9bcbfae4f2634d864a1ee1ce3ead9c. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for BTCB Token is 60/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $84.04M.
As of Sep 4, 2026, the 10 largest holders own 77.3% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
