Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is ether.fi governance token a Scam?

ETHFIEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on recordNew Launch · 3d old
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance1/10Upgrades6/10Checks passed3 of 5Findings3 Info3
SummaryAI Copilot

The EtherFiGovernanceToken contract implements a standard ERC20 token with burnable, permit, and voting functionalities, leveraging battle-tested OpenZeppelin libraries.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 50.1%
  • LP top3 unlocked holders = 81.9%
  • Token age < 7 days
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 30% (65.5% total → 46.3% effective; 33.5% in EOAs, 32.0% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 50.1% (independent LP — depth risk, pool = 65% of DEX liquidity)
  • LP top3 unlocked holders = 81.9% (independent LP — depth risk, pool = 65% of DEX liquidity)
  • Token age < 7 days (early, volatile)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (3d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
32.0%Contracts33.5%Wallets34.5%Everyone else
32.0%Contracts33.5%Wallets34.5%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
65.5%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking32.0%
  • Walletsanonymous holders, free to sell33.5%
  • Everyone elsethe rest of the supply34.5%
Effective concentrationwhat the score reads46.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.63M across 8 pairs
Show 1 more pair

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$1.06MShare of depth65.1%
Top-1 Unlocked Holder50.1%
Top-3 Unlocked81.9%
Unlocked LP held by
0xa772…f84f0x8483…5a310x2c42…82fa0x29d8…c0990x3d03…8a7b0x7f2f…9ef30x0793…bfea0xf13c…6dd30x319a…80a90x1169…b355

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 Info
Info

Initial Centralized Supply and Voting Power

The entire token supply (1,000,000,000 ETHFI) is minted to a single hardcoded address (0x7A6A…bB53) during contract deployment. This design choice results in 100% of the initial token supply and corresponding voting power being concentrated in one entity, posing a significant centralization risk for governance and potential single point of failure if the address is compromised.I-01

Issue

The entire token supply (1,000,000,000 ETHFI) is minted to a single hardcoded address () during contract deployment. This design choice results in 100% of the initial token supply and corresponding voting power being concentrated in one entity, posing a significant centralization risk for governance and potential single point of failure if the address is compromised.

Fix

While a design choice, it is crucial to ensure that the initial recipient address is secured with robust multi-signature controls and that a transparent, decentralized distribution plan is executed promptly to mitigate centralization risks and promote healthy governance.

Status

Unresolved

Info

Non-Upgradeability of Contract

The EtherFiGovernanceToken contract is deployed as a standard implementation contract and does not utilize any proxy patterns (e.g., UUPS, Transparent, Beacon). This means the contract's logic is immutable post-deployment and cannot be upgraded or modified. Any future bug fixes, feature enhancements, or changes to the token's behavior would require deploying an entirely new contract and migrating existing token holders.I-02

Issue

The EtherFiGovernanceToken contract is deployed as a standard implementation contract and does not utilize any proxy patterns (e.g., UUPS, Transparent, Beacon). This means the contract's logic is immutable post-deployment and cannot be upgraded or modified. Any future bug fixes, feature enhancements, or changes to the token's behavior would require deploying an entirely new contract and migrating existing token holders.

Fix

Acknowledge the implications of non-upgradeability. For a governance token, immutability can be a desired feature for trust. However, if future flexibility is deemed necessary, plan for potential token migration strategies or consider upgradeable proxy patterns for other protocol components.

Status

Unresolved

Info

Reliance on Standard OpenZeppelin Implementations

The contract extensively leverages standard, battle-tested OpenZeppelin contracts for its core functionalities (ERC20, ERC20Burnable, ERC20Permit, ERC20Votes). While this is a significant strength in terms of code security and reliability, it means the contract's functionality is limited to these standard implementations without custom business logic. The security of the contract is therefore largely dependent on the ongoing security and maintenance of the OpenZeppelin libraries.I-03

Issue

The contract extensively leverages standard, battle-tested OpenZeppelin contracts for its core functionalities (ERC20, ERC20Burnable, ERC20Permit, ERC20Votes). While this is a significant strength in terms of code security and reliability, it means the contract's functionality is limited to these standard implementations without custom business logic. The security of the contract is therefore largely dependent on the ongoing security and maintenance of the OpenZeppelin libraries.

Fix

Continue to monitor OpenZeppelin's security advisories and updates. Ensure that the specific versions of OpenZeppelin contracts used are up-to-date and free from known vulnerabilities. This reliance is generally a best practice, but awareness of its implications is important.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The EtherFiGovernanceToken contract implements a standard ERC20 token with burnable, permit, and voting functionalities, leveraging battle-tested OpenZeppelin libraries. The contract's technical security is high due to minimal custom logic and reliance on audited components. The primary area of consideration is the initial centralized distribution of the entire token supply to a single address, which impacts governance decentralization. The contract is not upgradeable, ensuring immutability but requiring new deployments for any future changes.

Technical10/10Low risk

The technical architecture (7.1) is robust, built upon well-audited OpenZeppelin contracts for ERC20, ERC20Burnable, ERC20Permit, and ERC20Votes. Code security (7.2) is strong, with minimal custom logic, reducing the surface area for vulnerabilities like reentrancy or integer overflows. The _update and nonces overrides correctly call their super implementations. Access control (7.3) is standard for an ERC20 token, with no custom administrative roles, which is appropriate for its design.

Governance1/10High risk

The economic model (7.4) involves a fixed total supply minted entirely to a single address () in the constructor. This initial distribution grants 100% of the voting power to this address, creating a significant centralization point for governance (7.5). While this is a design choice, it implies a reliance on the security and integrity of the initial recipient's management of these tokens for the health of the governance system.

Upgrades6/10Medium risk

The contract is deployed as a standard implementation and is not designed to be upgradeable (7.7). This eliminates upgrade-specific risks such as proxy misconfigurations or implementation logic errors during upgrades. However, it means that any future modifications, bug fixes, or feature enhancements would necessitate a new contract deployment and a migration process for token holders.

Final RecommendationWhat to do about this score

It is recommended to carefully manage the initial distribution of the tokens from the designated recipient address to foster decentralization and mitigate governance risks.

Implement robust off-chain processes and multi-signature controls for the initial token holder address. For future protocol evolution, consider the implications of the non-upgradeable design and plan for potential migration strategies if significant changes are anticipated.

Contract & Record

1 audit on record
TypeEtherFiGovernanceToken
NetworkEthereum
Token age3d
Contract0xfe0c…c0eb
Deployer0x2460…f1cd
Badge for your website
ether.fi governance token security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202629Low
  2. Aug 14, 202622Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
01Ethereum29LowwojakEthereum30LowInjectiveINJ · Ethereum28LowLighterLIT · Ethereum28LowAaveEthereum28LowBalancerBAL · Ethereum30Low

Would You Like a More Detailed Audit of ether.fi governance token?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page