Quantum Audit Logo

Is FinTech AI Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

FinTech AI FNA
0x0833…114e
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The provided code implements a custom ERC20 token with EIP-2612 permit functionality and a custom SafeMath library. The core ERC20 logic largely follows established patterns. However, a critical issue was identified in the EIP-712 DOMAIN_SEPARATOR calculation, which could invalidate permit signatures. Additionally, the custom SafeMath library introduces complexity, and the base contract lacks explicit access control for sensitive token operations.

1 High1 Medium1 Low1 Informational
Volume 24h
$18.2K
Liquidity
$148.0K
Price
$0.1064
Token Age
1y
Top 10 Holders
94.6%

Security Findings

1 High1 Med1 Low1 Info
High

Missing 'version' in EIP-712 DOMAIN_SEPARATOR Calculation

H-01The EIP-712 `DOMAIN_SEPARATOR` typehash includes `string version`, but the constructor's `abi.encode` call for `DOMAIN_SEPARATOR` only provides `name()`, `chainID`, and `address(this)`. The `version` string is omitted. This will result in an incorrect `DOMAIN_SEPARATOR`, causing `permit` signatures to be invalid or potentially vulnerable to replay attacks if the `name` and `chainId` are identical across different deployments with varying intended versions.
IssueThe EIP-712 `DOMAIN_SEPARATOR` typehash includes `string version`, but the constructor's `abi.encode` call for `DOMAIN_SEPARATOR` only provides `name()`, `chainID`, and `address(this)`. The `version` string is omitted. This will result in an incorrect `DOMAIN_SEPARATOR`, causing `permit` signatures to be invalid or potentially vulnerable to replay attacks if the `name` and `chainId` are identical across different deployments with varying intended versions.
FixEnsure the `DOMAIN_SEPARATOR` calculation in the `ERC20Permit` constructor includes a `version` string, consistent with the EIP-712 typehash. For example, add a `version_` parameter to the constructor and pass it to `abi.encode`.
StatusUnresolved
Medium

Complexity and Potential Precision/Gas Issues in Custom SafeMath Functions

M-01The custom `SafeMath` library includes several complex functions beyond basic arithmetic, such as `sqrrt`, `percentageAmount`, `substractPercentage`, `percentageOfTotal`, `quadraticPricing`, and `bondingCurve`. The `sqrrt` function uses an iterative approximation, which could be gas-intensive for very large numbers or if many iterations are required. The percentage calculations (`percentageAmount`, `substractPercentage`, `percentageOfTotal`) use a divisor of 1000 (permille), which might lead to precision loss for small amounts or if higher precision is expected (e.g., standard percentages out of 100).
IssueThe custom `SafeMath` library includes several complex functions beyond basic arithmetic, such as `sqrrt`, `percentageAmount`, `substractPercentage`, `percentageOfTotal`, `quadraticPricing`, and `bondingCurve`. The `sqrrt` function uses an iterative approximation, which could be gas-intensive for very large numbers or if many iterations are required. The percentage calculations (`percentageAmount`, `substractPercentage`, `percentageOfTotal`) use a divisor of 1000 (permille), which might lead to precision loss for small amounts or if higher precision is expected (e.g., standard percentages out of 100).
FixThoroughly review and test all custom `SafeMath` functions for gas efficiency, precision, and correctness against the intended mathematical and economic models. Consider using established libraries for complex mathematical operations if available. Document the expected precision and behavior of percentage calculations.
StatusUnresolved
Low

Lack of Explicit Access Control for Sensitive Base Functions

L-01The `_mint` and `_burn` functions in the `ERC20` base contract are declared as `internal virtual`. While this design allows derived contracts to implement them, the `ERC20` contract itself does not enforce any access control mechanisms (e.g., `onlyOwner`, `onlyMinterRole`) for these critical token supply management operations. Although the `AccessControl` library is imported, it is not utilized in the provided snippet.
IssueThe `_mint` and `_burn` functions in the `ERC20` base contract are declared as `internal virtual`. While this design allows derived contracts to implement them, the `ERC20` contract itself does not enforce any access control mechanisms (e.g., `onlyOwner`, `onlyMinterRole`) for these critical token supply management operations. Although the `AccessControl` library is imported, it is not utilized in the provided snippet.
FixThe derived contract (e.g., `ERC20TokenX`) must implement robust access control for `_mint` and `_burn` functions to prevent unauthorized token creation or destruction. This could involve using OpenZeppelin's `AccessControl` roles or an `Ownable` pattern.
StatusUnresolved
Info

Older Solidity Compiler Version (0.7.5)

I-01The contract is compiled with Solidity version 0.7.5. This version does not include native overflow/underflow checks, requiring the use of a custom `SafeMath` library. Newer Solidity versions (0.8.0 and above) include these checks by default, which can simplify code and reduce reliance on external libraries for basic arithmetic safety. Older compiler versions may also lack recent optimizations or security patches.
IssueThe contract is compiled with Solidity version 0.7.5. This version does not include native overflow/underflow checks, requiring the use of a custom `SafeMath` library. Newer Solidity versions (0.8.0 and above) include these checks by default, which can simplify code and reduce reliance on external libraries for basic arithmetic safety. Older compiler versions may also lack recent optimizations or security patches.
FixConsider upgrading the Solidity compiler version to 0.8.x or higher. This would allow for the removal of the `SafeMath` library for basic arithmetic operations, simplifying the codebase and leveraging native compiler security features. Ensure thorough testing if upgrading, as there might be minor breaking changes.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The technical architecture is based on a standard ERC20 token with EIP-2612 permit extensions. The contract utilizes a custom SafeMath library for arithmetic operations, which is appropriate for Solidity 0.7.5 to prevent overflows/underflows. However, the DOMAIN_SEPARATOR calculation for EIP-712 permit is incomplete, omitting the 'version' string, which is a critical flaw (7.2 Code Security). The custom 'sqrrt' function in SafeMath is an iterative approximation, potentially leading to gas inefficiencies or precision concerns (7.2 Code Security).

GovernanceHigh2/10

The economic model relies on custom arithmetic functions within SafeMath, such as 'percentageAmount' and 'quadraticPricing', which require careful validation against the intended design (7.4 Economic). The base ERC20 contract does not define explicit access control for '_mint' and '_burn' functions, which are critical for token supply management (7.3 Access Control). While these are 'internal virtual', the derived contract 'ERC20TokenX' must implement robust governance over these functions to prevent unauthorized supply changes.

UpgradesMedium4/10

The provided contract code does not implement any proxy patterns or upgrade mechanisms, indicating it is intended to be immutable (7.7 Upgrades). This simplifies the upgrade risk profile, as there are no upgradeability-specific vulnerabilities to consider. Any changes to the token's logic would require a new deployment and migration.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedPass
Not a ProxyPass

Holder Composition

94.6% in top 10
0.3% in wallets94.3% in contracts
Effective Concentration38.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$148.0K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

6 addresses
Deployer
0x4e46…370e
Unlocked LP Held By
0xd2be…f6ef0x0ed9…97060x5db8…e56a0x80d8…4ae90x28e2…e9df

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

9 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (94.6% total → 38.1% effective; 0.3% in EOAs, 94.3% in contracts — moderate)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • LP claimed locked but only 0.0% actually locked
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Infinity Ground AI (AIN)High RiskSOCKHigh RiskTopazHigh RiskAnoma (XAN)Critical RiskPlasma (XPL)Critical RiskMirex (MRX)Critical Risk

Would You Like a More Detailed Audit of FinTech AI?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit