Is Cubus Store Coin (CSC) Safe? Smart Contract Security Analysis

Security Findings

3 Info

Info

Limitations of `isContract` for Security Checks

I-01The `isContract` function, while useful for certain checks, has known limitations and is explicitly warned against being used for security-critical checks, especially to prevent flash loan attacks or to reliably distinguish between Externally Owned Accounts (EOAs) and contracts. It returns `false` for contracts in construction, destroyed contracts, or addresses where a contract will be created, making it unreliable for strict access control or attack prevention.

IssueThe `isContract` function, while useful for certain checks, has known limitations and is explicitly warned against being used for security-critical checks, especially to prevent flash loan attacks or to reliably distinguish between Externally Owned Accounts (EOAs) and contracts. It returns `false` for contracts in construction, destroyed contracts, or addresses where a contract will be created, making it unreliable for strict access control or attack prevention.

FixDevelopers should not rely on `isContract` as a primary security mechanism to prevent calls from contracts or to protect against flash loan attacks. Instead, robust access control mechanisms (e.g., `Ownable`, `AccessControl`), reentrancy guards, and careful state management should be employed for security-sensitive operations.

StatusUnresolved

Info

Reentrancy Risk with External Calls (sendValue)

I-02The `sendValue` function, which uses a low-level `call` to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not handled correctly by the calling contract. While `sendValue` itself uses `require` before the call (adhering to checks-effects-interactions for its own balance), the recipient can still re-enter the *calling* contract, potentially leading to unexpected behavior or fund drains.

IssueThe `sendValue` function, which uses a low-level `call` to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not handled correctly by the calling contract. While `sendValue` itself uses `require` before the call (adhering to checks-effects-interactions for its own balance), the recipient can still re-enter the *calling* contract, potentially leading to unexpected behavior or fund drains.

FixAny contract utilizing `sendValue` or other external call functions must strictly adhere to the checks-effects-interactions pattern. Implement reentrancy guards (e.g., OpenZeppelin's `ReentrancyGuard`) on functions that perform external calls and modify state, especially when handling Ether or tokens, to prevent malicious re-entry.

StatusUnresolved

Info

Safe Usage of Low-Level Call Wrappers

I-03The `Address` library provides several wrappers for low-level calls (`functionCall`, `functionCallWithValue`, `functionStaticCall`, `functionDelegateCall`). While these wrappers improve safety by handling error propagation and checking for contract existence (in `verifyCallResultFromTarget`), they still transfer control to an external address. Improper use by the calling contract can lead to unexpected behavior, gas limit issues, or reentrancy.

IssueThe `Address` library provides several wrappers for low-level calls (`functionCall`, `functionCallWithValue`, `functionStaticCall`, `functionDelegateCall`). While these wrappers improve safety by handling error propagation and checking for contract existence (in `verifyCallResultFromTarget`), they still transfer control to an external address. Improper use by the calling contract can lead to unexpected behavior, gas limit issues, or reentrancy.

FixWhen using these low-level call wrappers, developers must ensure that the target contract's behavior is well-understood and trusted. Implement robust input validation, handle potential reverts gracefully, and be mindful of gas limits and reentrancy risks, especially with `functionCallWithValue` and `functionDelegateCall` which involve value transfers or delegate logic execution.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The `Address` library (7.1 Architecture) is a robust and well-tested utility from OpenZeppelin, designed to provide safer interactions with addresses and low-level calls. It includes functions like `sendValue` and `functionCallWithValue` (7.2 Code Security) which abstract away common pitfalls of raw `call` operations, such as gas forwarding and error handling. The library explicitly warns users about potential reentrancy issues when using `sendValue` and the limitations of `isContract` (7.3 Access Control) for security purposes, demonstrating a strong focus on secure coding practices and user education.

GovernanceMedium6/10

The `Address` library is a foundational utility and does not incorporate any specific governance or economic mechanisms (7.4 Economic, 7.5 Governance). Its design is purely functional, providing low-level primitives without introducing complex protocol-level risks. Therefore, governance and economic risk levels are considered low, as these aspects are outside the scope of this library.

UpgradesLow10/10

As a Solidity library, `Address` is not designed to be an upgradeable contract (7.7 Upgrades). It is typically linked or embedded into other contracts at deployment. This design inherently avoids upgrade-related complexities and risks associated with proxy patterns or mutable logic, contributing to a low upgrade risk profile for the library itself.

Security Checklist

5/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedPass

Not a ProxyPass

Liquidity Depth

$430.2K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned80.7%

LP Locked80.7% · Null Address

Key Addresses

3 addresses

Deployer

0x01d8…7523

Unlocked LP Held By

0x81cb…797c0x0ed9…9706

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

2 factors

Top-10 concentration > 70% (197.1% total → 91.1% effective; 20.4% in EOAs, 176.7% in contracts — extreme)
Token age < 30 days (still settling)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Final Recommendation

AI Copilot

While the OpenZeppelin `Address` library itself is highly secure, its safe usage depends on the calling contract's implementation.…

Read the verdictHide

Developers integrating this library should meticulously review the explicit warnings provided in the NatSpec comments, particularly concerning the limitations of `isContract` and the reentrancy risks associated with external calls like `sendValue` and `functionCallWithValue`. Always apply the checks-effects-interactions pattern, utilize reentrancy guards where necessary, and thoroughly validate inputs and outputs for any external interactions facilitated by this library to ensure overall system security.

Contract

TypeToken

Audit History

1 audit on record

Aug 1217Sep 411

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Is Cubus Store Coin Safe?

Security Findings

Limitations of `isContract` for Security Checks

Reentrancy Risk with External Calls (sendValue)

Safe Usage of Low-Level Call Wrappers

Category Ratings

Security Checklist

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Cubus Store Coin?