Is ChainOpera AI (COAI) Safe? Smart Contract Security Analysis

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyFail

Audit History

2 audits on record

Jul 2280Jul 2352

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

The contract at 0x0a8d6c86e1bce73fe4d0bd531e1a567306836ea5 is an ERC-1967 UUPS proxy. While the proxy itself utilizes well-audited OpenZeppelin libraries, its implementation contract (0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877) is not source verified on BSCScan. This lack of transparency poses a critical security risk, as the actual logic, access control, and upgrade mechanisms are entirely unknown and could be malicious.

Final Recommendation: It is critically important to immediately verify the source code of the implementation contract at 0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877 on BSCScan. Until the implementation's source is publicly available and thoroughly audited, the contract should be considered unsafe for use, as its functionality, security, and upgradeability are entirely unknown. Users should exercise extreme caution.

Category Ratings

TechnicalMedium

5/10

The proxy contract correctly implements the ERC-1967 UUPS pattern using battle-tested OpenZeppelin libraries, which provides a strong foundation for architectural security (7.1 Architecture). However, the critical issue is that the underlying implementation contract (0xa9d0b1770ad65cbc4f5dffc0f24f42

GovernanceHigh

1/10

The economic model and governance mechanisms (7.4 Economic, 7.5 Governance) are entirely defined within the unverified implementation contract. Without its source code, it is impossible to determine if there are any backdoors, privileged roles, or economic exploits. This lack of transparency present

UpgradesHigh

2/10

The contract utilizes the UUPS proxy pattern, where the implementation contract itself controls upgrades (7.7 Upgrades). While UUPS is a standard pattern, the unverified nature of the implementation means that the upgrade logic is unknown. A malicious or compromised implementation could arbitrarily

Proxy Upgrade Controls

Proxy TypeEip1967 Uups

ImplementationVerified source

LP Distribution

Top-1 Unlocked Holder77.4%

Top-3 Unlocked96.1%

What Raised This Score

8 factors

Ownership NOT renounced — Timelock 48h delay (exit window)
Proxy contract (upgradeable — admin can replace logic)
Top-10 concentration > 30% (84.0% total → 35.9% effective; 3.8% in EOAs, 80.2% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 77.4% (independent LP — depth risk, pool = 99% of DEX liquidity)
LP top3 unlocked holders = 96.1% (independent LP — depth risk, pool = 99% of DEX liquidity)
1 Critical finding(s) from audit
2 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

4 total

1 Critical 2 High 1 Info

C-01CriticalUnresolved

Unverified Implementation Contract

The proxy contract at 0x0a8d6c86e1bce73fe4d0bd531e1a567306836ea5 delegates all calls to its implementation contract at 0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877. However, the source code for this implementation contract is not verified on BSCScan. This means the actual logic, state variables, and security mechanisms of the contract are unknown, making it impossible to assess its safety or functionality. This is a fundamental security flaw (7.2 Code Security).

Recommendation: Immediately verify the source code of the implementation contract (0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877) on BSCScan. Without source verification, the contract should be considered unauditable and unsafe.

H-01HighUnresolved

Opaque Upgrade Mechanism

The contract uses the UUPS (Universal Upgradeable Proxy Standard) pattern, where the implementation contract itself contains the upgrade logic. Since the implementation contract (0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877) is unverified, the upgrade mechanism (7.7 Upgrades) is opaque. A malicious or compromised implementation could contain arbitrary upgrade logic, allowing an attacker to change the proxy's implementation to a contract with malicious code, potentially leading to a complete loss of funds or control.

Recommendation: Verify the source code of the implementation contract to allow for a thorough audit of its upgrade logic. Ensure that upgrade permissions are appropriately restricted, ideally to a multi-signature wallet or a time-locked governance contract.

H-02HighUnresolved

Unknown Functionality and Access Control

All core functionality, including asset handling, privileged roles, and critical operations, resides within the unverified implementation contract (0xa9d0b1770ad65cbc4f5dffc0f24f42c57933a877). Without its source code, it is impossible to determine the contract's intended behavior, assess its access control mechanisms (7.3 Access Control), or identify potential backdoors or vulnerabilities that could lead to unauthorized actions or economic exploits (7.4 Economic).

Recommendation: Verify the source code of the implementation contract to enable a full security assessment of its functionality, access control, and economic model. Implement robust access control with multi-signature or time-lock mechanisms for critical functions.

I-01InformationalResolved

Adherence to ERC-1967 UUPS Standard

The proxy contract itself correctly implements the ERC-1967 UUPS proxy pattern using battle-tested OpenZeppelin libraries. This indicates a standard and well-understood architectural approach (7.1 Architecture) for upgradeability, assuming the implementation contract is also secure.

Recommendation: No direct recommendation for the proxy contract itself, as it follows established standards. The primary recommendation is to ensure the security of the implementation contract.

Is ChainOpera AI Safe? COAI