Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is Catecoin a Scam?

CATEBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 19, 2026 · 1 audit on recordNew Launch · 20h old
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance6/10Upgrades6/10Checks passed6 of 7Findings1 Critical · 1 High · 1 Medium · 1 Low · 6 Info10
SummaryAI Copilot

The audited Token contract on BSC implements standard ERC-20 tokenomics with built-in liquidity fee handling and fee exclusions.

Read the full analysis
What raised the score
  • Volume/Liquidity > 15×
  • Code: Arbitrary Token Pull in Swap Routine
  • Code: Precision Loss Due to Division Before Multiplication
  • Code: Permanent Locking of Received Native Assets
  • Code: Unchecked Return Value in External Token Transfers
Exact factors
  • Volume/Liquidity > 15× (57.6× — wash-trading signal)
  • Code: Arbitrary Token Pull in Swap Routine (Critical, static analysis)
  • Code: Precision Loss Due to Division Before Multiplication (Low, static analysis)
  • Code: Permanent Locking of Received Native Assets (Medium, static analysis)
  • Code: Unchecked Return Value in External Token Transfers (High, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (20h old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Oct 196 of 7 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax3.9% / 3.9%

Holders

as of audit · Oct 19, 202643,339 holders
94.0%Burned5.7%
94.0%Burned5.7%
BurnedDEX poolsEveryone elseBubble area = share of supply
94.3%of supply sits with the top 10 holders
  • Burnedout of circulation94.0%
  • DEX poolsthe pools' own liquidity0.3%
  • Everyone else43,329 holders5.7%
Effective concentrationwhat the score reads0.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 19, 2026

Liquidity

as of audit · Oct 19$162.8K

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$162.8KShare of depth100.0%
LP Locked97.2% · Null Address, PinkLock02
Top-1 Unlocked Holder1.8%
Unlocked LP held by
0x0ed9…97060xbe52…cf34

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 High1 Medium1 Low6 Info
Critical

Arbitrary Token Pull in Swap Routine

The internal function _executeSwapAndLiquify executes transferFrom using an address that the caller can manipulate or that draws from third-party balances. Anyone who has approved the contract can have their tokens transferred without their direct authorization.CD-01

Issue

The internal function _executeSwapAndLiquify executes transferFrom using an address that the caller can manipulate or that draws from third-party balances. Anyone who has approved the contract can have their tokens transferred without their direct authorization.

Fix

Refactor _executeSwapAndLiquify to only transfer tokens held directly in the contract's own balance using address(this) rather than pulling from external user balances.

Status

Unresolved

High

Unchecked Return Value in External Token Transfers

The function _executeSwapAndLiquify performs ERC-20 token transfers without checking the returned boolean status. If a transfer fails silently, the contract continues execution under the false assumption that funds were moved.CD-04

Issue

The function _executeSwapAndLiquify performs ERC-20 token transfers without checking the returned boolean status. If a transfer fails silently, the contract continues execution under the false assumption that funds were moved.

Fix

Use OpenZeppelin's SafeERC20 safeTransfer and safeTransferFrom functions to verify successful transfer execution and revert on failure.

Status

Unresolved

Medium

Permanent Locking of Received Native Assets

The contract implements a receive function that accepts native BNB payments but lacks any withdrawal function or outgoing transfer mechanism, causing any sent funds to be permanently trapped.CD-03

Issue

The contract implements a receive function that accepts native BNB payments but lacks any withdrawal function or outgoing transfer mechanism, causing any sent funds to be permanently trapped.

Fix

Remove the receive function if native assets are not required, or implement an explicit, protected sweep function to route received native currency to a secure receiver.

Status

Unresolved

Low

Precision Loss Due to Division Before Multiplication

In _executeSwapAndLiquify and _transfer, mathematical calculations perform division before multiplication, leading to avoidable rounding loss and truncated fee amounts during token processing.CD-02

Issue

In _executeSwapAndLiquify and _transfer, mathematical calculations perform division before multiplication, leading to avoidable rounding loss and truncated fee amounts during token processing.

Fix

Reorder mathematical expressions to perform all multiplication steps prior to division, preserving precision throughout fee and liquidity calculations.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 94.3% of supply. Of that, 94.0% burned, 0.3% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.0% in wallets, 0.0% in other contracts. 43,339 holders in total.QA-HOLDERS

Issue

The ten largest holders own 94.3% of supply. Of that, 94.0% burned, 0.3% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.0% in wallets, 0.0% in other contracts. 43,339 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Not listed by any independent source

43,339 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.QA-IDENTITY

Issue

43,339 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

Liquidity time-locked

97.2% of the pool's LP is burned or time-locked. 97.3% is locked in PinkLock02 until 19 Nov 2026 (30 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 2.7% is held, unlocked, by 2 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

97.2% of the pool's LP is burned or time-locked. 97.3% is locked in PinkLock02 until 19 Nov 2026 (30 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. 2.7% is held, unlocked, by 2 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

The market for this token

Liquidity $163K (DexScreener, all pools). 24h trading volume $9.4M (DexScreener, all pools).QA-MARKET

Issue

Liquidity $163K (DexScreener, all pools). 24h trading volume $9.4M (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Meme token

A community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: meme vocabulary in name/ticker (cat). Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 3.9% on buy, 3.94% on sell. Market: $163K of DEX liquidity across 1 pools. Launch: under a day of market history.QA-PROFILE

Issue

A community token whose value comes from attention rather than a product. Being a meme is not a risk in itself: it is scored on exactly the same contract and market facts as any other token. The class itself adds no points; the contract and market facts decide the score. Basis: meme vocabulary in name/ticker (cat). Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 3.9% on buy, 3.94% on sell. Market: $163K of DEX liquidity across 1 pools. Launch: under a day of market history.

Fix

Expect attention-driven volatility; the facts in this report say whether the contract itself can be used against holders.

Status

Acknowledged

Info

Recently launched — less than a day of market history

The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.QA-RECENT

Issue

The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.

Fix

Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 19
Executive SummaryWhat the contract is and what the review found

The audited Token contract on BSC implements standard ERC-20 tokenomics with built-in liquidity fee handling and fee exclusions. Contract ownership has been verified as renounced on-chain, rendering all owner-restricted administration functions permanently dormant. However, critical vulnerabilities exist in internal automated swap logic where unauthorized token movements can occur, alongside unhandled transfer returns and trapped native assets.

Technical6/10Medium risk

Under 7.1 Architecture, the token relies on standard ERC-20 foundations and structured modular inheritance from OpenZeppelin Context and Ownable. Regarding 7.2 Code Security, fundamental validation is present across basic transfer flows, but severe logic gaps exist such as unchecked return values in _executeSwapAndLiquify and calculation imprecision. In terms of 7.3 Access Control, owner-restricted entry points are safely disabled via renounced ownership, yet automated internal functions expose dangerous arbitrary transfer capabilities.

Governance6/10Medium risk

Under 7.5 Governance, the contract eliminates administrative rug-pull vectors because contract ownership is renounced and owner functions like setExclusionFromFee are rendered dormant. In 7.4 Economic considerations, fixed supply parameters prevent arbitrary inflation, though fee deductions and automated liquidity routing introduce potential slippage and extraction vectors. Examining 7.6 External factors, liquidity interactions via _executeSwapAndLiquify lack defensive transfer checks, leaving economic reserves exposed to token interaction failures.

Upgrades6/10Medium risk

In 7.7 Upgrades, the contract is deployed as an immutable non-proxy instance, ensuring that bytecode cannot be altered or hijacked post-deployment. Regarding 7.8 Operations, routine user transactions function predictably through immutable transfer pathways, providing stable predictability. The principal operational weakness stems from a receive function that locks incoming native BNB permanently due to the absence of withdrawal logic.

Final RecommendationWhat to do about this score

Users should exercise extreme caution when granting allowances to this contract.

Because _executeSwapAndLiquify can pull tokens from arbitrary addresses holding allowances, users must strictly avoid approving tokens to the contract beyond exact transaction requirements or consider revoking approvals entirely. For future iterations, the development team must ensure that liquidity management routines only transfer tokens directly owned by the contract rather than relying on caller-defined addresses. Additionally, safe transfer wrappers such as SafeERC20 should be integrated, rounding operations sequenced after multiplications, and dedicated withdrawal methods implemented for any native currency received.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age20h
Contract0x5b9e…f1e2
Deployer0xd669…1e71
Audit History
  1. Oct 19, 202674High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
SOLANASOL · BNB Chain74HighelizaOSBNB Chain73High金蟾JIN · BNB Chain75HighbStocks Never SleepBSTOCKS · BNB Chain75HighZcash TokenZEC · BNB Chain73HighWorldMobileTokenWMTX · BNB Chain75High

Would You Like a More Detailed Audit of Catecoin?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page