On-chain security analysis — is it a scam or legit?
BNB ChainEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
How the supply is spread across holders could not be read — the indexer's holder list does not add up to the supply. Check the largest holders on a block explorer, which reads current balances.
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x81cb…797c0x0ed9…9706No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
isContract for Security ChecksisContract function, while useful for certain checks, has known limitations and is explicitly warned against being used for security-critical checks, especially to prevent flash loan attacks or to reliably distinguish between Externally Owned Accounts (EOAs) and contracts. It returns false for contracts in construction, destroyed contracts, or addresses where a contract will be created, making it unreliable for strict access control or attack prevention.I-01The isContract function, while useful for certain checks, has known limitations and is explicitly warned against being used for security-critical checks, especially to prevent flash loan attacks or to reliably distinguish between Externally Owned Accounts (EOAs) and contracts. It returns false for contracts in construction, destroyed contracts, or addresses where a contract will be created, making it unreliable for strict access control or attack prevention.
Developers should not rely on isContract as a primary security mechanism to prevent calls from contracts or to protect against flash loan attacks. Instead, robust access control mechanisms (e.g., Ownable, AccessControl), reentrancy guards, and careful state management should be employed for security-sensitive operations.
Unresolved
sendValue function, which uses a low-level call to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not handled correctly by the calling contract. While sendValue itself uses require before the call (adhering to checks-effects-interactions for its own balance), the recipient can still re-enter the *calling* contract, potentially leading to unexpected behavior or fund drains.I-02The sendValue function, which uses a low-level call to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not handled correctly by the calling contract. While sendValue itself uses require before the call (adhering to checks-effects-interactions for its own balance), the recipient can still re-enter the *calling* contract, potentially leading to unexpected behavior or fund drains.
Any contract utilizing sendValue or other external call functions must strictly adhere to the checks-effects-interactions pattern. Implement reentrancy guards (e.g., OpenZeppelin's ReentrancyGuard) on functions that perform external calls and modify state, especially when handling Ether or tokens, to prevent malicious re-entry.
Unresolved
Address library provides several wrappers for low-level calls (functionCall, functionCallWithValue, functionStaticCall, functionDelegateCall). While these wrappers improve safety by handling error propagation and checking for contract existence (in verifyCallResultFromTarget), they still transfer control to an external address. Improper use by the calling contract can lead to unexpected behavior, gas limit issues, or reentrancy.I-03The Address library provides several wrappers for low-level calls (functionCall, functionCallWithValue, functionStaticCall, functionDelegateCall). While these wrappers improve safety by handling error propagation and checking for contract existence (in verifyCallResultFromTarget), they still transfer control to an external address. Improper use by the calling contract can lead to unexpected behavior, gas limit issues, or reentrancy.
When using these low-level call wrappers, developers must ensure that the target contract's behavior is well-understood and trusted. Implement robust input validation, handle potential reverts gracefully, and be mindful of gas limits and reentrancy risks, especially with functionCallWithValue and functionDelegateCall which involve value transfers or delegate logic execution.
Unresolved
This audit covers the OpenZeppelin Address utility library. The library itself is a widely used and thoroughly audited component, providing safe wrappers for low-level address operations. The identified findings are primarily informational, highlighting important considerations and warnings explicitly documented within the library for its safe and secure integration into other contracts.
The Address library (7.1 Architecture) is a robust and well-tested utility from OpenZeppelin, designed to provide safer interactions with addresses and low-level calls. It includes functions like sendValue and functionCallWithValue (7.2 Code Security) which abstract away common pitfalls of raw call operations, such as gas forwarding and error handling. The library explicitly warns users about potential reentrancy issues when using sendValue and the limitations of isContract (7.3 Access Control) for security purposes, demonstrating a strong focus on secure coding practices and user education.
The Address library is a foundational utility and does not incorporate any specific governance or economic mechanisms (7.4 Economic, 7.5 Governance). Its design is purely functional, providing low-level primitives without introducing complex protocol-level risks. Therefore, governance and economic risk levels are considered low, as these aspects are outside the scope of this library.
As a Solidity library, Address is not designed to be an upgradeable contract (7.7 Upgrades). It is typically linked or embedded into other contracts at deployment. This design inherently avoids upgrade-related complexities and risks associated with proxy patterns or mutable logic, contributing to a low upgrade risk profile for the library itself.
While the OpenZeppelin Address library itself is highly secure, its safe usage depends on the calling contract's implementation.
Developers integrating this library should meticulously review the explicit warnings provided in the NatSpec comments, particularly concerning the limitations of isContract and the reentrancy risks associated with external calls like sendValue and functionCallWithValue.
Always apply the checks-effects-interactions pattern, utilize reentrancy guards where necessary, and thoroughly validate inputs and outputs for any external interactions facilitated by this library to ensure overall system security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Cubus Store Coin (CSC) contract on BNB Chain is 0x02962e4188902e05c4b1856e065551bcce10ffff. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Cubus Store Coin is 11/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $430.2K.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
