Quantum Audit Logo

Is Dexe Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Dexe DEXE
0x6e88…ce3e
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

This audit report covers the provided OpenZeppelin utility libraries (`StorageSlot` and `Address`) and general observations regarding the Beacon proxy structure for the BridgeToken protocol. The core business logic for the `BridgeToken` and its `TokenImplementation` was not provided, limiting the scope of this audit. A key concern identified is the unverified administration of the Beacon contract, which controls the upgrade path for all associated proxies.

1 Medium1 Low2 Informational
Volume 24h
$6.9K
Liquidity
$3.9K
Price
$0.5841
Token Age
2y
Top 10 Holders
93.9%

Security Findings

1 Med1 Low2 Info
Medium

Unverified Beacon Admin Control

M-01The audit notes indicate that the administrator for the Beacon contract (0xb6f6…a6e7), which dictates the implementation address for all associated proxies, could not be classified. For a Beacon proxy system, the security of the Beacon's admin is paramount. An unmanaged, single-point-of-failure, or compromised Beacon admin could lead to unauthorized upgrades, potentially deploying malicious contract logic and compromising user funds or protocol integrity.
IssueThe audit notes indicate that the administrator for the Beacon contract (), which dictates the implementation address for all associated proxies, could not be classified. For a Beacon proxy system, the security of the Beacon's admin is paramount. An unmanaged, single-point-of-failure, or compromised Beacon admin could lead to unauthorized upgrades, potentially deploying malicious contract logic and compromising user funds or protocol integrity.
FixProvide the source code for the Beacon contract and clarify its administrative control mechanisms. It is strongly recommended that the Beacon's admin be secured by a robust multi-signature wallet (e.g., Gnosis Safe) or a time-locked governance contract to prevent single points of failure and provide a delay for critical changes.
StatusUnresolved
Low

Core Contract Logic Not Provided for Audit

L-01The primary business logic for the `BridgeToken` (proxy) and its `TokenImplementation` (implementation) contracts was not provided for review. This audit is therefore limited to the provided OpenZeppelin libraries and general observations about the proxy structure. A comprehensive security assessment of the protocol's specific functionalities, access control, economic model, and potential vulnerabilities (e.g., reentrancy, integer overflows) cannot be performed without the full source code.
IssueThe primary business logic for the `BridgeToken` (proxy) and its `TokenImplementation` (implementation) contracts was not provided for review. This audit is therefore limited to the provided OpenZeppelin libraries and general observations about the proxy structure. A comprehensive security assessment of the protocol's specific functionalities, access control, economic model, and potential vulnerabilities (e.g., reentrancy, integer overflows) cannot be performed without the full source code.
FixProvide the complete source code for all contracts comprising the BridgeToken protocol, including the `BridgeToken` proxy, `TokenImplementation`, and the Beacon contract, for a full and thorough security audit. This will enable a detailed analysis of the entire system's security posture.
StatusUnresolved
Info

Standard Library Usage

I-01The provided contract code utilizes well-audited and widely adopted OpenZeppelin libraries (`StorageSlot.sol` and `Address.sol`). These libraries are known for their high quality, security, and adherence to best practices in smart contract development. Their inclusion contributes positively to the overall code reliability.
IssueThe provided contract code utilizes well-audited and widely adopted OpenZeppelin libraries (`StorageSlot.sol` and `Address.sol`). These libraries are known for their high quality, security, and adherence to best practices in smart contract development. Their inclusion contributes positively to the overall code reliability.
FixContinue to leverage well-vetted and community-audited libraries like OpenZeppelin to reduce the risk of introducing common vulnerabilities. Ensure that the specific versions used are up-to-date and free from known exploits.
StatusUnresolved
Info

Beacon Proxy Pattern Identified

I-02The contract at 0x6e88…ce3e is identified as a Beacon proxy, delegating its logic to an implementation contract (0x7f8c…f22a) via a Beacon contract (0xb6f6…a6e7). This pattern allows multiple proxies to share and upgrade their implementation logic through a single Beacon, promoting efficiency and consistency.
IssueThe contract at is identified as a Beacon proxy, delegating its logic to an implementation contract () via a Beacon contract (). This pattern allows multiple proxies to share and upgrade their implementation logic through a single Beacon, promoting efficiency and consistency.
FixEnsure that the Beacon proxy pattern is fully understood and correctly implemented across all associated contracts. Pay close attention to the security of the Beacon contract itself, as it is a central point of control for upgrades.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The provided code consists of OpenZeppelin's `StorageSlot` and `Address` libraries (7.2 Code Security). These libraries are widely used, well-audited, and adhere to high security standards, providing robust utilities for storage management and safe address interactions. No direct vulnerabilities were found within these specific library implementations. However, the core logic of the `BridgeToken` and its `TokenImplementation` was not available for technical review, which limits the assessment of the overall system's technical security (7.1 Architecture).

GovernanceHigh1/10

The economic and governance aspects of the `BridgeToken`'s core functionality could not be assessed due to the absence of its source code (7.4 Economic, 7.5 Governance). However, the identified Beacon proxy pattern introduces a critical governance component: the Beacon contract's administrator. The audit notes indicate that the Beacon admin's control could not be classified, posing a potential risk if not adequately secured. An unmanaged or compromised Beacon admin could lead to unauthorized upgrades, impacting the protocol's integrity and user funds (7.3 Access Control).

UpgradesHigh1/10

The protocol utilizes a Beacon proxy pattern, allowing for efficient upgrades of multiple proxy instances through a single Beacon contract (7.7 Upgrades). While this pattern is robust, the security of the Beacon contract's administrator is paramount, as this entity controls which implementation contract is used by all associated proxies. The inability to classify the Beacon admin's control mechanism represents a significant upgrade safety concern, as unauthorized parties could potentially deploy malicious implementations. Proper access control for the Beacon admin is crucial for maintaining upgrade integrity (7.3 Access Control).

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeBeacon
ImplementationVerified source

Holder Composition

93.9% in top 10
50.6% in wallets43.3% in contracts
Effective Concentration68.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$4.0K across 6 pairs

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.7%
Top-3 Unlocked100.0%

Key Addresses

5 addresses
Deployer
0x4706…1492
Unlocked LP Held By
0x5d8e…c82d0x34b9…ed160x899d…7cca0xb754…9c05

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

11 factors
  • Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Complex proxy pattern (BEACON)
  • Top-10 concentration > 50% (93.9% total → 68.0% effective; 50.6% in EOAs, 43.3% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $10k ($3,970 across 6 pairs — easily drained)
  • LP top1 unlocked holder = 99.7% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Arcium (ARX)Critical RiskSolstice (SLX)Critical RiskFLOKICritical RiskBlock Street (BSB)Critical RiskLIGHTCritical RiskUnited Stables (U)Critical Risk

Would You Like a More Detailed Audit of Dexe?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit