Is CAT a Scam? Security Analysis

Security Findings

1 High3 Med1 Low1 Info

High

Centralized Control Across All Contracts

H-01All three contracts (`CATToken`, `CatClaim`, `PolyJetClub`) are `Ownable` and explicitly prevent ownership renouncement. This design concentrates extensive power in a single 3/5 multisig address, which controls all critical operations including token blacklisting, fund transfers from blacklisted accounts, claim amount management, NFT minting, and pausing. This introduces a significant single point of control and high trust requirement in the owner (7.3, 7.5, 7.8).

IssueAll three contracts (`CATToken`, `CatClaim`, `PolyJetClub`) are `Ownable` and explicitly prevent ownership renouncement. This design concentrates extensive power in a single 3/5 multisig address, which controls all critical operations including token blacklisting, fund transfers from blacklisted accounts, claim amount management, NFT minting, and pausing. This introduces a significant single point of control and high trust requirement in the owner (7.3, 7.5, 7.8).

FixConsider implementing time-locks for highly sensitive owner-controlled functions to introduce a delay before execution, allowing for community review or emergency intervention. Explore progressive decentralization strategies, such as transitioning to a DAO-based governance model for critical decisions like blacklisting or major fund movements, reducing reliance on a single multisig.

StatusUnresolved

Medium

Owner's Power Over Blacklisted Funds

M-01In `CATToken`, the `transferBlackFunds` function allows the owner to unilaterally transfer all tokens from a blacklisted address to any non-blacklisted recipient. While intended for recovery or enforcement, this grants significant power to the owner over user funds, which could be misused or lead to disputes if not handled transparently (7.3, 7.4).

IssueIn `CATToken`, the `transferBlackFunds` function allows the owner to unilaterally transfer all tokens from a blacklisted address to any non-blacklisted recipient. While intended for recovery or enforcement, this grants significant power to the owner over user funds, which could be misused or lead to disputes if not handled transparently (7.3, 7.4).

FixImplement a clear policy and transparent process for the use of `transferBlackFunds`, communicating the conditions under which it will be invoked. Consider requiring a multi-signature approval or a time-lock for such transfers to add an additional layer of security and accountability.

StatusUnresolved

Medium

Owner's Control Over Claimable Amounts and Funds

M-02In `CatClaim`, the owner has exclusive control over setting and resetting claimable amounts for any user via `setClaimableAmount` and `setClaimableAmounts`. Additionally, the owner can deposit and withdraw all CAT tokens from the contract using `depositCat` and `withdrawCat`. This centralization means the owner has full discretion over who can claim, how much, and can manage or drain the contract's funds at any time (7.3, 7.4).

IssueIn `CatClaim`, the owner has exclusive control over setting and resetting claimable amounts for any user via `setClaimableAmount` and `setClaimableAmounts`. Additionally, the owner can deposit and withdraw all CAT tokens from the contract using `depositCat` and `withdrawCat`. This centralization means the owner has full discretion over who can claim, how much, and can manage or drain the contract's funds at any time (7.3, 7.4).

FixIf possible, explore mechanisms to decentralize the setting of claimable amounts, perhaps through a pre-defined schedule or a community-governed process. For fund withdrawals, consider implementing a time-lock or requiring a higher threshold of multisig signers for large amounts to enhance security and trust.

StatusUnresolved

Medium

Owner's Control Over NFT Minting and Metadata

M-03In `PolyJetClub`, the owner possesses exclusive rights to mint all NFTs up to `MAX_SUPPLY` via `mint` and `batchMint`, and can change the `baseURI` at any time using `setBaseURI`. This centralization allows the owner to control the entire distribution and metadata of the NFT collection, potentially impacting its perceived value or authenticity if the owner's key is compromised or acts maliciously (7.3, 7.4).

IssueIn `PolyJetClub`, the owner possesses exclusive rights to mint all NFTs up to `MAX_SUPPLY` via `mint` and `batchMint`, and can change the `baseURI` at any time using `setBaseURI`. This centralization allows the owner to control the entire distribution and metadata of the NFT collection, potentially impacting its perceived value or authenticity if the owner's key is compromised or acts maliciously (7.3, 7.4).

FixConsider implementing a time-lock for `setBaseURI` to provide transparency before metadata changes. For minting, if a public sale or decentralized distribution is planned, ensure the owner's minting capabilities are limited or phased out after initial distribution, or integrate a transparent minting schedule.

StatusUnresolved

Low

Pausability Centralization

L-01All contracts implement pausable functionality, allowing the owner to halt core contract operations (e.g., token transfers, claims, NFT minting) at will. While a common emergency mechanism, this feature is entirely controlled by the owner, which could disrupt user activity or be used to freeze assets without immediate recourse (7.3, 7.8).

IssueAll contracts implement pausable functionality, allowing the owner to halt core contract operations (e.g., token transfers, claims, NFT minting) at will. While a common emergency mechanism, this feature is entirely controlled by the owner, which could disrupt user activity or be used to freeze assets without immediate recourse (7.3, 7.8).

FixClearly document the conditions under which the pause functionality would be invoked. For enhanced decentralization, consider requiring a multi-signature approval or a time-lock for pausing and unpausing, especially for prolonged periods, to prevent arbitrary halts.

StatusUnresolved

Info

Immutable Contract Design

I-01The contracts are deployed as immutable implementations and do not incorporate any upgradeability mechanisms (e.g., proxy patterns). While this eliminates risks associated with complex upgrade processes, it means that any future bug fixes, feature enhancements, or changes to the protocol logic would necessitate a complete redeployment of the contracts and a migration of assets, which can be a complex and costly process (7.7).

IssueThe contracts are deployed as immutable implementations and do not incorporate any upgradeability mechanisms (e.g., proxy patterns). While this eliminates risks associated with complex upgrade processes, it means that any future bug fixes, feature enhancements, or changes to the protocol logic would necessitate a complete redeployment of the contracts and a migration of assets, which can be a complex and costly process (7.7).

FixEnsure comprehensive testing and auditing are conducted prior to deployment, given the immutability of the contracts. For future projects, evaluate the trade-offs between immutability and upgradeability based on the project's long-term vision and potential for evolving requirements.

StatusUnresolved

Category Ratings

TechnicalMedium6/10

The technical implementation demonstrates strong adherence to best practices, leveraging battle-tested OpenZeppelin libraries for ERC-20, ERC-721, Ownable, Pausable, and ReentrancyGuard functionalities. Solidity 0.8.28 is used, mitigating common integer overflow/underflow issues. For instance, `CatClaim` correctly employs `ReentrancyGuard` for its `claim` function, preventing reentrancy attacks. The code is generally clean, well-structured, and uses custom error messages effectively. No significant technical vulnerabilities like reentrancy (where not guarded), oracle manipulation, or complex logical flaws were identified (7.2).

GovernanceHigh1/10

The governance and economic model exhibits a high degree of centralization, with a 3/5 multisig owner retaining extensive control over all core contract functionalities. This includes the ability to blacklist token holders and transfer their funds in `CATToken` (7.4), manage all claimable amounts and withdraw funds from `CatClaim` (7.4), and control NFT minting and metadata in `PolyJetClub` (7.4). While a multisig mitigates single-point-of-failure, the concentration of power introduces significant trust assumptions and potential for economic manipulation or abuse (7.5). Ownership renouncement is explicitly disabled across all contracts, solidifying this centralized control (7.3).

UpgradesMedium6/10

The contracts are deployed as immutable, non-upgradeable implementations. This design choice eliminates risks associated with proxy patterns, such as storage collisions, logic errors during upgrades, or unauthorized upgrade paths (7.7). However, it also means that any future bug fixes, feature enhancements, or changes to the protocol logic would necessitate a complete redeployment of the contracts and a migration of assets, which can be a complex and costly process.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

95.1% in top 10

5.5% in wallets89.7% in contracts

Effective Concentration41.3%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$15.52M across 3 pairs

Pancakeswap v2USDTanalysed$15.52M Pancakeswap v2WBNB$80 Pancakeswap v279AU$12

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder63.1%

Top-3 Unlocked99.7%

Key Addresses

11 addresses

Deployer

0x6a3b…2e69

Unlocked LP Held By

0x0385…c4f80x8abe…7ba40x2494…1a270x80fd…7e360x0123…426a0xdff8…99ca0x1c70…460c0xa3e5…15940x818e…8b2f0x80b9…8ca8

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

What Raised This Score

8 factors

Ownership NOT renounced — strong Multisig (3-of-5)
Top-10 concentration > 30% (95.1% total → 41.3% effective; 5.5% in EOAs, 89.7% in contracts — moderate)
Liquidity NOT locked (owner can withdraw — rug-pull risk)
LP top1 unlocked holder = 63.1% (exit-liquidity risk)
LP top3 unlocked holders = 99.7% (exit-liquidity risk)
1 High finding(s) from audit
3 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Final Recommendation

AI Copilot

The project demonstrates robust technical implementation using established OpenZeppelin standards.…

Read the verdictHide

The primary area for improvement lies in decentralizing control where feasible. Consider implementing time-locks for critical owner-controlled functions or introducing community governance mechanisms for sensitive operations like blacklisting, fund withdrawals, or NFT metadata changes. For immutable contracts, ensure thorough testing and auditing before deployment, as any post-deployment changes require costly redeployment. Evaluate the long-term implications of centralized control over core assets and functionalities, and explore strategies to progressively decentralize power as the project matures to enhance trust and resilience.

Contract

TypeCATToken

Audit History

1 audit on record

Aug 1482

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Is CAT a Scam?

Security Findings

Centralized Control Across All Contracts

Owner's Power Over Blacklisted Funds

Owner's Control Over Claimable Amounts and Funds

Owner's Control Over NFT Minting and Metadata

Pausability Centralization

Immutable Contract Design

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of CAT?