Quantum Audit Logo

Is CoinMarketCap 20 Index DTF Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

CoinMarketCap 20 Index DTF CMC20
0x2f8a…6867
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

The Folio contract serves as an upgradeable ERC20 token managing a basket of assets, incorporating features like fees, rebalancing, and trusted fillers. The contract leverages OpenZeppelin's upgradeable standards, reentrancy guards, and access control. Key strengths include the use of a Timelock for administrative actions and a robust fee distribution mechanism. However, the system exhibits a high degree of centralized control by the admin role, and relies on complex, unaudited external components for core economic functions like rebalancing and auctions. The presence of deprecated code also adds to complexity.

1 High2 Medium1 Low1 Informational
Volume 24h
$792.0K
Liquidity
$1.69M
Price
$166.0420
Token Age
9mo
Top 10 Holders
86.9%

Security Findings

1 High2 Med1 Low1 Info
High

Centralized Control by DEFAULT_ADMIN_ROLE

H-01The `DEFAULT_ADMIN_ROLE` possesses extensive control over critical contract parameters, including setting fees (`setTVLFee`, `setMintFee`, `setFeeRecipients`), managing basket assets (`addToBasket`, `removeFromBasket`), configuring rebalancing (`setRebalanceControl`), enabling/disabling trusted fillers (`setTrustedFillerRegistry`), and deprecating the entire Folio (`deprecateFolio`). While this role is assigned to a Timelock contract with a 2-day delay, this concentration of power means that a compromise of the Timelock's owner could lead to significant financial loss or protocol manipulation. (7.3 Access Control, 7.5 Governance, 7.4 Economic)
IssueThe `DEFAULT_ADMIN_ROLE` possesses extensive control over critical contract parameters, including setting fees (`setTVLFee`, `setMintFee`, `setFeeRecipients`), managing basket assets (`addToBasket`, `removeFromBasket`), configuring rebalancing (`setRebalanceControl`), enabling/disabling trusted fillers (`setTrustedFillerRegistry`), and deprecating the entire Folio (`deprecateFolio`). While this role is assigned to a Timelock contract with a 2-day delay, this concentration of power means that a compromise of the Timelock's owner could lead to significant financial loss or protocol manipulation. (7.3 Access Control, 7.5 Governance, 7.4 Economic)
FixConsider implementing a multi-signature wallet for the Timelock's owner or further decentralizing control over highly sensitive parameters where feasible, perhaps through community governance or additional timelocks for specific actions.
StatusUnresolved
Medium

Unaudited External Rebalancing and Auction Logic

M-01The `Folio` contract integrates complex rebalancing and auction mechanisms through external libraries (`RebalancingLib`) and interfaces (`ITrustedFillerRegistry`, `IBaseTrustedFiller`). The provided code snippet does not include the full implementation of these external components. Without a comprehensive audit of these external contracts and libraries, their security, potential for manipulation, front-running, or economic exploits cannot be fully assessed. (7.6 External, 7.4 Economic, 7.1 Architecture)
IssueThe `Folio` contract integrates complex rebalancing and auction mechanisms through external libraries (`RebalancingLib`) and interfaces (`ITrustedFillerRegistry`, `IBaseTrustedFiller`). The provided code snippet does not include the full implementation of these external components. Without a comprehensive audit of these external contracts and libraries, their security, potential for manipulation, front-running, or economic exploits cannot be fully assessed. (7.6 External, 7.4 Economic, 7.1 Architecture)
FixConduct a thorough security audit of all external contracts and libraries, specifically `RebalancingLib`, `ITrustedFillerRegistry`, and `IBaseTrustedFiller`, to ensure their robustness and prevent vulnerabilities that could impact the `Folio` contract.
StatusUnresolved
Medium

Dependency on External IFolioDAOFeeRegistry

M-02The calculation of DAO fees in the `mint` function (and potentially other fee-related operations) relies on the `getFeeDetails` function of an external `IFolioDAOFeeRegistry` contract. The security and integrity of this external registry are paramount. If the `daoFeeRegistry` were compromised or misconfigured, it could lead to incorrect fee calculations, unexpected fee distributions, or denial of service for fee-related operations within the `Folio` contract. (7.6 External, 7.4 Economic)
IssueThe calculation of DAO fees in the `mint` function (and potentially other fee-related operations) relies on the `getFeeDetails` function of an external `IFolioDAOFeeRegistry` contract. The security and integrity of this external registry are paramount. If the `daoFeeRegistry` were compromised or misconfigured, it could lead to incorrect fee calculations, unexpected fee distributions, or denial of service for fee-related operations within the `Folio` contract. (7.6 External, 7.4 Economic)
FixEnsure the `IFolioDAOFeeRegistry` contract is highly secure, immutable, or managed by a robust governance process. Implement robust input validation and consider circuit breakers or fallback mechanisms in case of unexpected behavior from the external registry.
StatusUnresolved
Low

Risk from Malicious or Non-Standard ERC20 Tokens

L-01The `addToBasket` function allows the `DEFAULT_ADMIN_ROLE` to add any ERC20 token. While `SafeERC20` is used for token interactions, malicious or non-standard ERC20 tokens (e.g., those with re-entrant `transferFrom` hooks, fee-on-transfer mechanisms, or tokens that can be paused/blacklisted) could still introduce unexpected behavior, lead to loss of funds, or disrupt the contract's operations (e.g., rebalancing, minting, redeeming). (7.6 External, 7.4 Economic)
IssueThe `addToBasket` function allows the `DEFAULT_ADMIN_ROLE` to add any ERC20 token. While `SafeERC20` is used for token interactions, malicious or non-standard ERC20 tokens (e.g., those with re-entrant `transferFrom` hooks, fee-on-transfer mechanisms, or tokens that can be paused/blacklisted) could still introduce unexpected behavior, lead to loss of funds, or disrupt the contract's operations (e.g., rebalancing, minting, redeeming). (7.6 External, 7.4 Economic)
FixImplement a strict whitelist for approved ERC20 tokens that have been thoroughly vetted for standard behavior. Consider adding additional checks or safeguards when interacting with newly added tokens.
StatusUnresolved
Info

Presence of Deprecated Code and Variables

I-01The contract contains several variables and structs explicitly marked with `_DEPRECATED` (e.g., `auctions_DEPRECATED`, `sellEnds_DEPRECATED`, `DeprecatedStruct`). While these are likely inactive or remnants of previous versions, their presence adds to the code's complexity, increases the cognitive load for auditors and developers, and could potentially lead to confusion or unintended interactions if not completely isolated or removed. (7.1 Architecture, 7.2 Code Security)
IssueThe contract contains several variables and structs explicitly marked with `_DEPRECATED` (e.g., `auctions_DEPRECATED`, `sellEnds_DEPRECATED`, `DeprecatedStruct`). While these are likely inactive or remnants of previous versions, their presence adds to the code's complexity, increases the cognitive load for auditors and developers, and could potentially lead to confusion or unintended interactions if not completely isolated or removed. (7.1 Architecture, 7.2 Code Security)
FixConsider removing all deprecated code and variables to improve code clarity, reduce the attack surface, and simplify future maintenance and audits. If removal is not feasible, ensure they are clearly documented as unreachable and have no impact on current logic.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The Folio contract demonstrates good technical practices, utilizing OpenZeppelin's upgradeable contracts, `ReentrancyGuardUpgradeable`, and `SafeERC20` for secure token interactions (7.2 Code Security). The `initialize` function correctly sets up the contract, and fee distribution logic (`distributeFees()` before fee changes) is well-implemented. However, the contract's reliance on external libraries and interfaces for complex rebalancing and auction logic introduces an unassessed technical risk (7.6 External, 7.1 Architecture). The presence of deprecated code also adds unnecessary complexity (7.1 Architecture).

GovernanceHigh1/10

The governance and economic model features a `DEFAULT_ADMIN_ROLE` with extensive control over critical parameters, including fees, basket assets, and rebalancing settings (7.3 Access Control, 7.5 Governance). While this role is protected by a Timelock with a 2-day delay, the centralization of power remains a high-risk factor. The fee distribution mechanism is designed to distribute pending fees before parameter changes, which is a strong point (7.4 Economic). However, the contract's economic stability heavily depends on the integrity and security of the external `IFolioDAOFeeRegistry` and the complex, unaudited rebalancing/auction logic (7.4 Economic, 7.6 External).

UpgradesHigh1/10

The contract is designed for upgradeability using OpenZeppelin's `Initializable` and `Upgradeable` patterns, including `__ERC20_init`, `__AccessControlEnumerable_init`, and `__ReentrancyGuard_init` (7.7 Upgrades). The constructor correctly calls `_disableInitializers()`. This standard approach minimizes upgrade-related risks, provided that future upgrades meticulously manage storage layout to prevent collisions and ensure backward compatibility. The `Versioned` contract also suggests a structured approach to upgrades.

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin
ImplementationVerified source

Holder Composition

86.9% in top 10
44.9% in wallets42.1% in contracts
Effective Concentration61.7%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$3.49M across 8 pairs
Pancakeswap v3USDTanalysed$1.69M48.5%Pancakeswap v3WBNB$1.65M47.3%Pancakeswap v3BTCB$146.3K4.2%Pancakeswap v2XPHX$1130.0%Pancakeswap v2Cbit$670.0%Pancakeswap v3WBNB$10.0%
Show 1 more pairShow less
Pancakeswap v2WBNB$00.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.4%
Top-3 Unlocked99.8%

Key Addresses

11 addresses
Deployer
0x89e6…58ae
Unlocked LP Held By
0x1b13…458c0xc3f6…3f1e0x3998…39760xf547…f2a70x7dc7…ac9c0xcade…5a380x9675…a6270xebc4…d7960xdbee…73170x41ce…7788

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

10 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 50% (86.9% total → 61.7% effective; 44.9% in EOAs, 42.1% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 99.4% (independent LP — depth risk, pool = 49% of DEX liquidity)
  • LP top3 unlocked holders = 99.8% (independent LP — depth risk, pool = 49% of DEX liquidity)
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Anoma (XAN)Critical RiskPlasma (XPL)Critical RiskMirex (MRX)Critical RiskPancakeSwap Token (CAKE)Critical RiskSubsquid (SQD)Critical RiskInfinity Ground AI (AIN)High Risk

Would You Like a More Detailed Audit of CoinMarketCap 20 Index DTF?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit