Quantum Audit Logo

Is Cedar Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Cedar CDR
HZqjje…6o9C
Solana
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

This audit of the Cedar (CDR) SPL token mint identifies a medium risk due to the entire DEX liquidity pool being unlocked and held by a single program account, which could be withdrawn at any time. Additionally, the token's metadata is mutable, allowing for changes to its name, symbol, or image post-launch. Third-party registry data indicated single holder ownership and mutable metadata, while chain-native RPC data for holder distribution was unavailable.

2 Medium1 Low5 Informational
Volume 24h
$78.7K
Liquidity
$439.7K
Price
$0.00368
Token Age
1y
Top 10 Holders
45.0%

Security Findings

2 Med1 Low5 Info
Medium

Pool Liquidity Not Locked

M-01Only 0.0% of the pool's liquidity is burned or locked; 100.0% is held, unlocked, by a program account (2sV6GC…A2D8) which can remove that share at once. Who controls this program account is not visible on-chain, so it is not treated as an independent provider.
IssueOnly 0.0% of the pool's liquidity is burned or locked; 100.0% is held, unlocked, by a program account (2sV6GC…A2D8) which can remove that share at once. Who controls this program account is not visible on-chain, so it is not treated as an independent provider.
FixWatch the program account (2sV6GC…A2D8) that holds the liquidity; treat the pool as removable until the liquidity is burned or locked.
StatusUnresolved
Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the pool's creator. One of them — a program account, 2sV6GC…A2D8 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider.
Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the pool's creator. One of them — a program account, 2sV6GC…A2D8 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Low

Mutable Metadata

L-01Token name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`.
IssueToken name, symbol, or image can be changed post-launch, as indicated by `metadata_mutable: True`.
FixVerify metadata against off-chain expectations before trusting branding.
StatusUnresolved
Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 45.0% of supply. Of that, 7.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 11.4% in wallets, 26.4% in other contracts. 5,605 holders in total.
IssueThe ten largest holders own 45.0% of supply. Of that, 7.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 11.4% in wallets, 26.4% in other contracts. 5,605 holders in total.
FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
StatusAcknowledged
Info

Listed, but not independently verified

QA-IDENTITYListed on CoinGecko as Cedar (CDR), market cap $3M, rank #2068. 5,605 holders.
IssueListed on CoinGecko as Cedar (CDR), market cap $3M, rank #2068. 5,605 holders.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

The market for this token

QA-MARKETLiquidity $440K (DexScreener, all pools). 24h trading volume $85K (CoinGecko, all markets, daily snapshot). 24h trading volume $79K (DexScreener, all pools).
IssueLiquidity $440K (DexScreener, all pools). 24h trading volume $85K (CoinGecko, all markets, daily snapshot). 24h trading volume $79K (DexScreener, all pools).
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

What the token's controller can do

QA-POWERSThe contract lets its controller — nobody (ownership renounced) — change the token's name, symbol and image. Ownership is renounced, so nobody can use them now.
IssueThe contract lets its controller — nobody (ownership renounced) — change the token's name, symbol and image. Ownership is renounced, so nobody can use them now.
FixCheck who holds these powers and whether a timelock or multisig stands between them and holders.
StatusAcknowledged
Info

Asset class: Project token

QA-PROFILEA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $440K of DEX liquidity across 1 pools. Launch: 420 days of market history.
IssueA token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $440K of DEX liquidity across 1 pools. Launch: 420 days of market history.
FixCheck the project's own documentation for what the token is used for; this report covers what the contract allows.
StatusAcknowledged

Category Ratings

TechnicalLow10/10

The Cedar (CDR) token is an SPL token operating under the `spl-token` program. Key authorities, including the Mint Authority and Freeze Authority, have been revoked, indicating a fixed supply and inability to freeze accounts (7.3 Access Control). The token has 9 decimals and is initialized. It does not utilize Token-2022 extensions such as permanent delegates, transfer hooks, or default frozen account states, simplifying its on-chain behavior (7.1 Architecture).

GovernanceHigh2/10

The economic profile shows a moderate holder concentration, with the top 10 holders that can sell accounting for 37.75% of the total supply. The token has a healthy liquidity of $439,675 USD, with a normal 24-hour volume to liquidity ratio of 0.18, suggesting genuine trading activity for its 420-day old pair. However, a significant concern is that 100.0% of the pool's liquidity is unlocked and held by a single program account (2sV6GC…A2D8), which can be withdrawn at any moment, posing a risk to market stability (7.4 Economic).

UpgradesLow8/10

The token's core authorities, Mint Authority and Freeze Authority, are revoked, preventing further minting or freezing of accounts. While the token does not use Token-2022 specific upgradeable features like transfer fee or transfer hook upgradability, its metadata is mutable. This means the token's name, symbol, or image can be altered after launch, which could lead to branding inconsistencies or confusion (7.7 Upgrades).

Security Checklist

3/4 checks passed
Contract VerifiedPass
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Liquidity Depth

$439.7K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

What Raised This Score

2 factors
  • Liquidity NOT locked (100% of the pool) — who holds it cannot be verified
  • Top-10 concentration > 20% (45.0% total → 21.9% effective; 11.4% in EOAs, 26.4% in contracts; 7.2% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
TOES (TOESCOIN)Low RiskMumu the Bull (MUMU)Low RiskfebuLow RiskBullshit Coin (BULLSHIT)Low RiskPoet Toads (TOADS)Low RiskMinirouter.sh (MINI)Low Risk

Would You Like a More Detailed Audit of Cedar?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit