On-chain security analysis — is it a scam or legit?
BNB ChainThe FourERC20 contract is an ERC-20 token implementation based on OpenZeppelin.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 6, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x0ed9…97060x9cfc…e62b0xafea…b6560x0a90…2bb20x22fe…a1750x4e89…e2750x556a…1b0b0x8d58…123f0x0819…928fNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
FourERC20 contract, which inherits from Context and implements IERC20, lacks a constructor. The internal _init function, responsible for setting the token's _name and _symbol, is never called. More critically, the _totalSupply remains at its default value of zero, and since the internal _mint function is not exposed or called by any public function, no tokens can ever be created. This renders the token completely non-functional and unusable, as it will always have a zero supply and no identifiable name or symbol. (7.1 Architecture, 7.2 Code Security, 7.4 Economic)C-01The FourERC20 contract, which inherits from Context and implements IERC20, lacks a constructor. The internal _init function, responsible for setting the token's _name and _symbol, is never called. More critically, the _totalSupply remains at its default value of zero, and since the internal _mint function is not exposed or called by any public function, no tokens can ever be created. This renders the token completely non-functional and unusable, as it will always have a zero supply and no identifiable name or symbol. (7.1 Architecture, 7.2 Code Security, 7.4 Economic)
A constructor must be added to the FourERC20 contract (or its derived contract) that calls _init(string memory name_, string memory symbol_) to set the token's metadata. Additionally, the constructor or a controlled public function should call _mint(address account, uint256 amount) to establish an initial token supply.
Unresolved
FourERC20 contract provides the core ERC-20 logic but keeps the _mint and _burn functions internal. This design implies that FourERC20 is intended as a base contract for inheritance, where a derived contract would implement specific supply mechanisms (e.g., a fixed supply, minter role, pauser role). As a standalone contract, it lacks the ability to create or destroy tokens after deployment (assuming a constructor would handle initial minting). (7.1 Architecture)I-01The FourERC20 contract provides the core ERC-20 logic but keeps the _mint and _burn functions internal. This design implies that FourERC20 is intended as a base contract for inheritance, where a derived contract would implement specific supply mechanisms (e.g., a fixed supply, minter role, pauser role). As a standalone contract, it lacks the ability to create or destroy tokens after deployment (assuming a constructor would handle initial minting). (7.1 Architecture)
If this contract is intended to be a standalone, deployable token, consider adding public or role-based functions to manage token supply (e.g., mint(address to, uint256 amount) with an onlyOwner or onlyMinter modifier). If it's strictly a base, ensure the derived contract correctly implements supply management.
Unresolved
_init Function Usage_init function is designed to set the _name and _symbol of the token. Being an internal function, it must be explicitly called by a constructor of the contract itself or a derived contract. If not called, _name and _symbol will remain empty strings, which is not standard for an ERC-20 token and can cause issues with interfaces displaying token information. (7.1 Architecture)I-02The _init function is designed to set the _name and _symbol of the token. Being an internal function, it must be explicitly called by a constructor of the contract itself or a derived contract. If not called, _name and _symbol will remain empty strings, which is not standard for an ERC-20 token and can cause issues with interfaces displaying token information. (7.1 Architecture)
Ensure that any contract inheriting FourERC20 or FourERC20 itself, includes a constructor that calls _init with appropriate name_ and symbol_ parameters.
Unresolved
The FourERC20 contract is an ERC-20 token implementation based on OpenZeppelin. A critical architectural flaw prevents the token from being initialized or having any supply, rendering it unusable. The contract lacks a constructor, meaning its name, symbol, and initial supply cannot be set, resulting in a permanent zero total supply.
The contract is a basic ERC-20 implementation leveraging OpenZeppelin's Context library. It correctly implements standard ERC-20 functions and includes mitigations for allowance race conditions (7.2 Code Security). However, a critical architectural oversight means the contract lacks a constructor, preventing the _init function from being called and any tokens from ever being minted (7.1 Architecture). This renders the token completely non-functional.
The economic model is severely impacted by the critical technical flaw (7.4 Economic). With no constructor to initialize _name, _symbol, or mint an initial supply, the token will have a permanent totalSupply of zero. This makes the token economically worthless and unusable. There are no governance mechanisms present (7.5 Governance).
The contract is not designed to be upgradeable (7.7 Upgrades). This simplifies its architecture by avoiding proxy-related complexities and potential upgrade safety issues.
The current FourERC20 contract is fundamentally flawed due to the absence of a constructor, which prevents proper initialization and token minting.
It is strongly recommended to redeploy a corrected version. The new contract must include a constructor that calls _init with desired name and symbol, and also calls _mint to establish an initial token supply.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
