Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Cross Safe?

CROSSBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades6/10Checks passed3 of 5Findings1 High · 1 Medium · 1 Info3
SummaryAI Copilot

The CrossToken contract implements a standard ERC20 token with burnable and permit functionalities, leveraging battle-tested OpenZeppelin libraries.

Read the full analysis
What raised the score
  • Ownership not renounced — owner is an EOA
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
Exact factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Top-10 concentration > 30% (98.3% total → 43.4% effective; 6.8% in EOAs, 91.4% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
91.4%Contracts6.8%
91.4%Contracts6.8%
ContractsWalletsEveryone elseBubble area = share of supply
98.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking91.4%
  • Walletsanonymous holders, free to sell6.8%
  • Everyone elsethe rest of the supply1.7%
Effective concentrationwhat the score reads43.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.07M across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$1.07MShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x8c5f…984e0x6458…2df5

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Info
High

Centralized Control Over Token Supply via Burn Function

The burn function in the CrossToken contract is protected by the onlyOwner modifier. This grants the contract owner exclusive power to reduce the total supply of tokens at any time. While this can be a desired feature for supply management, it introduces a significant centralization risk (7.4 Economic). A malicious or compromised owner could burn a substantial amount of tokens, leading to a drastic devaluation or even a rug pull scenario for token holders.H-01

Issue

The burn function in the CrossToken contract is protected by the onlyOwner modifier. This grants the contract owner exclusive power to reduce the total supply of tokens at any time. While this can be a desired feature for supply management, it introduces a significant centralization risk (7.4 Economic). A malicious or compromised owner could burn a substantial amount of tokens, leading to a drastic devaluation or even a rug pull scenario for token holders.

Fix

If the ability to burn tokens is essential, consider implementing a more decentralized approach, such as requiring a multi-signature approval for burn operations or integrating a time-lock mechanism. Alternatively, if the owner's control is intentional, ensure robust security measures for the owner's private key and transparently communicate this capability to the community.

Status

Unresolved

Medium

Single Point of Failure Due to EOA Ownership

The CrossToken contract is currently owned by an External Owned Account (EOA) (7.5 Governance). This creates a single point of failure, as the security of the entire contract's administrative functions (including the ability to burn tokens) relies solely on the security of that single EOA's private key. If this EOA is compromised, an attacker could gain full control over the owner-restricted functions, leading to potential misuse and loss of funds.M-01

Issue

The CrossToken contract is currently owned by an External Owned Account (EOA) (7.5 Governance). This creates a single point of failure, as the security of the entire contract's administrative functions (including the ability to burn tokens) relies solely on the security of that single EOA's private key. If this EOA is compromised, an attacker could gain full control over the owner-restricted functions, leading to potential misuse and loss of funds.

Fix

Transfer ownership of the contract to a multi-signature wallet (e.g., Gnosis Safe). A multi-sig wallet requires multiple independent approvals for transactions, significantly enhancing security by distributing control and reducing the risk associated with a single compromised key.

Status

Unresolved

Info

Immutability of Contract Logic

The CrossToken contract is deployed directly and does not implement any upgradeability mechanism (7.7 Upgrades). This means that once deployed, the contract's logic cannot be modified. While this eliminates risks associated with upgrade mechanisms (e.g., proxy vulnerabilities), it also implies that any discovered bugs or desired feature enhancements would necessitate deploying an entirely new contract and migrating all token holders, which can be a complex and costly process.I-01

Issue

The CrossToken contract is deployed directly and does not implement any upgradeability mechanism (7.7 Upgrades). This means that once deployed, the contract's logic cannot be modified. While this eliminates risks associated with upgrade mechanisms (e.g., proxy vulnerabilities), it also implies that any discovered bugs or desired feature enhancements would necessitate deploying an entirely new contract and migrating all token holders, which can be a complex and costly process.

Fix

This is a design choice. If immutability is intended, no action is required. If future flexibility is desired, consider implementing an upgradeable proxy pattern (e.g., UUPS) for future deployments, though this adds complexity and its own set of risks.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The CrossToken contract implements a standard ERC20 token with burnable and permit functionalities, leveraging battle-tested OpenZeppelin libraries. The technical implementation is robust, with no apparent critical vulnerabilities. However, the contract design introduces centralization risks due to the owner's exclusive control over the burn function and the use of an EOA for ownership, which could impact token economics and governance if compromised or misused.

Technical8/10Low risk

The CrossToken contract is built upon battle-tested OpenZeppelin ERC20, ERC20Burnable, ERC20Permit, and Ownable libraries, ensuring a high degree of code security and adherence to ERC standards (7.2 Code Security). The architecture is straightforward, implementing a standard token with an owner-controlled burn function (7.1 Architecture). No complex custom logic or external interactions are present, minimizing technical attack vectors and ensuring robust operation.

Governance1/10High risk

The primary economic and governance risk stems from the centralized control over the token's burn function, which is restricted to the contract owner (7.4 Economic). This allows a single entity to reduce the total supply, potentially impacting token value. Furthermore, the contract is owned by an External Owned Account (EOA) (7.5 Governance), which presents a single point of failure; compromise of this EOA could lead to misuse of the burn capability, posing a significant risk to token holders.

Upgrades6/10Medium risk

The CrossToken contract is not designed with upgradeability in mind (7.7 Upgrades). It is deployed as an immutable contract, meaning its logic cannot be altered post-deployment. While this eliminates upgrade-specific risks like proxy misconfigurations, it also means that any future bug fixes or feature enhancements would necessitate a new contract deployment and token migration, which can be a complex and costly process.

Final RecommendationWhat to do about this score

It is strongly recommended to transfer ownership of the CrossToken contract to a robust multi-signature wallet (e.g., Gnosis Safe).

This would distribute control over critical functions like burn among multiple trusted parties, significantly mitigating the risk associated with a single point of failure (EOA ownership). Additionally, consider clearly communicating the implications of the owner-controlled burn function to token holders to ensure transparency regarding potential supply adjustments and maintain trust within the community.

Contract & Record

1 audit on record
TypeCrossToken
NetworkBNB Chain
Token age1y
Contract0x6bf6…a510
Deployer0xc360…4a41
Badge for your website
Cross security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 13, 202653Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the CROSS contract address?

The Cross contract on BNB Chain is 0x6bf62ca91e397b5a7d1d6bce97d9092065d7a510. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Cross a scam?

Quantum Audit's risk score for Cross is 53/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is CROSS liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $1.07M.

Who holds CROSS?

As of Sep 4, 2026, the 10 largest holders own 98.3% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
CookieBNB Chain53Medium永生果蝇BNB Chain53MediumPeppinBNB Chain53MediumChainOpera AICOAI · BNB Chain52MediumYooldo GamesESPORTS · BNB Chain52MediumAKEBNB Chain52Medium

Would You Like a More Detailed Audit of Cross?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page