Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Decentrawood Safe?

DEODBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance3/10Upgrades6/10Checks passed3 of 5Findings1 Low · 3 Info4
SummaryAI Copilot

The Decentrawood contract implements a standard ERC-20 token with burnable functionality, leveraging well-audited OpenZeppelin Contracts v5.5.0. The contract is simple, with a fixed total supply minted to a specified recipient during deployment.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 20%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 20% (72.2% total → 29.6% effective; 1.2% in EOAs, 71.0% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 80% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 80% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
71.0%Contracts1.2%27.8%Everyone else
71.0%Contracts27.8%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
72.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking71.0%
  • Walletsanonymous holders, free to sell1.2%
  • Everyone elsethe rest of the supply27.8%
Effective concentrationwhat the score reads29.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$79.8K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$63.7KShare of depth79.8%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x565e…2766

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low3 Info
Low

Critical Constructor Parameter for Initial Supply

The entire initial token supply (2 billion DEOD tokens) is minted to a single recipient address specified in the constructor. If this address is incorrectly provided during deployment (e.g., a typo, an unowned address, or a blackholed address), the entire token supply could become permanently inaccessible or lost. This represents a critical operational risk during deployment (7.8 Operations).L-01

Issue

The entire initial token supply (2 billion DEOD tokens) is minted to a single recipient address specified in the constructor. If this address is incorrectly provided during deployment (e.g., a typo, an unowned address, or a blackholed address), the entire token supply could become permanently inaccessible or lost. This represents a critical operational risk during deployment (7.8 Operations).

Fix

Ensure rigorous verification of the recipient address before deployment. Consider using a multi-signature wallet as the recipient to enhance security and decentralization of control over the initial token supply, mitigating the risk of a single point of failure.

Status

Unresolved

Info

Reliance on Standard OpenZeppelin Libraries

The Decentrawood contract extensively utilizes well-audited and battle-tested OpenZeppelin Contracts (ERC20 and ERC20Burnable, v5.5.0). This significantly reduces the likelihood of common vulnerabilities associated with custom token implementations, such as reentrancy, integer overflows/underflows, or incorrect ERC-20 standard adherence. This approach enhances the overall security posture of the contract (7.2 Code Security).I-01

Issue

The Decentrawood contract extensively utilizes well-audited and battle-tested OpenZeppelin Contracts (ERC20 and ERC20Burnable, v5.5.0). This significantly reduces the likelihood of common vulnerabilities associated with custom token implementations, such as reentrancy, integer overflows/underflows, or incorrect ERC-20 standard adherence. This approach enhances the overall security posture of the contract (7.2 Code Security).

Fix

No action required. This is a strength of the implementation. Continue to monitor OpenZeppelin updates and security advisories for any potential upstream issues.

Status

Unresolved

Info

Fixed Token Supply and Immutability of Parameters

The Decentrawood token has a fixed total supply of 2 billion tokens, minted exclusively during contract deployment. The token's name ("Decentrawood") and symbol ("Deod") are also set immutably in the constructor. There are no functions to mint additional tokens, modify the total supply (beyond user-initiated burning), or change the token's metadata post-deployment. This design choice ensures predictable tokenomics (7.4 Economic) but limits future flexibility.I-02

Issue

The Decentrawood token has a fixed total supply of 2 billion tokens, minted exclusively during contract deployment. The token's name ("Decentrawood") and symbol ("Deod") are also set immutably in the constructor. There are no functions to mint additional tokens, modify the total supply (beyond user-initiated burning), or change the token's metadata post-deployment. This design choice ensures predictable tokenomics (7.4 Economic) but limits future flexibility.

Fix

Ensure that the project's long-term vision and tokenomics model are fully compatible with an immutable, fixed-supply token. If future adjustments to supply or metadata are ever anticipated, a different contract design or upgradeability pattern would be required.

Status

Unresolved

Info

Absence of Administrative Roles and Access Control

The Decentrawood contract does not implement any administrative roles, such as Ownable or AccessControl (7.3 Access Control). This means there is no single entity or group with special permissions to pause transfers, blacklist addresses, upgrade the contract, or modify any operational parameters post-deployment. This design aligns with a fully decentralized and immutable token, but it also means no emergency intervention capabilities are available.I-03

Issue

The Decentrawood contract does not implement any administrative roles, such as Ownable or AccessControl (7.3 Access Control). This means there is no single entity or group with special permissions to pause transfers, blacklist addresses, upgrade the contract, or modify any operational parameters post-deployment. This design aligns with a fully decentralized and immutable token, but it also means no emergency intervention capabilities are available.

Fix

Confirm that the absence of administrative control aligns with the project's decentralization goals and risk tolerance. If any form of administrative control (e.g., pausing in emergencies, future feature additions) is desired, it would require a re-design of the contract to include appropriate access control mechanisms.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The Decentrawood contract implements a standard ERC-20 token with burnable functionality, leveraging well-audited OpenZeppelin Contracts v5.5.0. The contract is simple, with a fixed total supply minted to a specified recipient during deployment. No complex logic, governance mechanisms, or upgradeability features are present, contributing to a low overall risk profile. Key operational considerations include the immutability of token parameters and the critical importance of the initial recipient address.

Technical10/10Low risk

The technical architecture (7.1) is straightforward, implementing a standard ERC-20 token. Code security (7.2) is robust due to the exclusive reliance on OpenZeppelin Contracts v5.5.0, which are extensively audited and widely adopted, minimizing custom code vulnerabilities. The contract uses Solidity ^0.8.27, benefiting from recent compiler optimizations and safety features. No complex external interactions (7.6) or intricate logic are present, further reducing the attack surface. The primary technical consideration is the correct specification of the constructor's recipient address.

Governance3/10High risk

The economic model (7.4) for the Decentrawood token is simple: a fixed supply is minted at deployment, and the token is burnable. There are no complex tokenomics, staking, or lending mechanisms, which simplifies economic analysis. The contract lacks any governance mechanisms (7.5), meaning no on-chain voting or administrative control over token parameters post-deployment. This design choice ensures immutability and predictability, but also means no flexibility for future protocol adjustments. The primary economic risk is the initial distribution to a single recipient.

Upgrades6/10Medium risk

The Decentrawood contract is not designed to be upgradeable (7.7). It is deployed as an immutable contract, meaning its logic cannot be changed after deployment. This eliminates risks associated with upgrade mechanisms, such as proxy implementation bugs or insecure upgrade paths. However, it also means that any discovered vulnerabilities or desired feature enhancements would require a new contract deployment and migration.

Final RecommendationWhat to do about this score

It is recommended to thoroughly verify the deployment parameters, especially the recipient address in the constructor, to prevent the loss of the initial token supply.

Given the contract's immutability, ensure that the fixed token supply and lack of administrative control align with the long-term vision for the Decentrawood project. Consider a multi-signature wallet for the initial recipient if the tokens are intended for a community or treasury, to enhance security and decentralization of control over the initial supply.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age6mo
Contract0x3510…683e
Deployer0x1731…c46d
Badge for your website
Decentrawood security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202627Low
  2. Aug 8, 202642Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the DEOD contract address?

The Decentrawood (DEOD) contract on BNB Chain is 0x3510fbbc13090f991ffa523527113a166161683e. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Decentrawood a scam?

Quantum Audit's risk score for Decentrawood is 27/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is DEOD liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $79.8K.

Who holds DEOD?

As of Sep 4, 2026, the 10 largest holders own 72.2% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Baby AsteroidBABYASTEROID · BNB Chain27LowBroccoliBNB Chain27LowLABBNB Chain26LowMatthewCoinBNB Chain28LowKoma InuKOMA · BNB Chain26LowBillion Zone XchangeZBX · BNB Chain28Low

Would You Like a More Detailed Audit of Decentrawood?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page