Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is FinTech AI Safe?

FNABNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance2/10Upgrades4/10Checks passed3 of 5Findings1 High · 1 Medium · 1 Low · 1 Info4
SummaryAI Copilot

The provided code implements a custom ERC20 token with EIP-2612 permit functionality and a custom SafeMath library.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30%
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • LP claimed locked but only 0.0% actually locked
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (94.6% total → 38.1% effective; 0.3% in EOAs, 94.3% in contracts — moderate)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • LP claimed locked but only 0.0% actually locked
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockLocked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
94.3%Contracts5.4%
94.3%Contracts5.4%
ContractsWalletsEveryone elseBubble area = share of supply
94.6%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking94.3%
  • Walletsanonymous holders, free to sell0.3%
  • Everyone elsethe rest of the supply5.4%
Effective concentrationwhat the score reads38.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$148.0K

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$148.0KShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0xd2be…f6ef0x0ed9…97060x5db8…e56a0x80d8…4ae90x28e2…e9df

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low1 Info
High

Missing 'version' in EIP-712 DOMAIN_SEPARATOR Calculation

The EIP-712 DOMAIN_SEPARATOR typehash includes string version, but the constructor's abi.encode call for DOMAIN_SEPARATOR only provides name(), chainID, and address(this). The version string is omitted. This will result in an incorrect DOMAIN_SEPARATOR, causing permit signatures to be invalid or potentially vulnerable to replay attacks if the name and chainId are identical across different deployments with varying intended versions.H-01

Issue

The EIP-712 DOMAIN_SEPARATOR typehash includes string version, but the constructor's abi.encode call for DOMAIN_SEPARATOR only provides name(), chainID, and address(this). The version string is omitted. This will result in an incorrect DOMAIN_SEPARATOR, causing permit signatures to be invalid or potentially vulnerable to replay attacks if the name and chainId are identical across different deployments with varying intended versions.

Fix

Ensure the DOMAIN_SEPARATOR calculation in the ERC20Permit constructor includes a version string, consistent with the EIP-712 typehash. For example, add a version_ parameter to the constructor and pass it to abi.encode.

Status

Unresolved

Medium

Complexity and Potential Precision/Gas Issues in Custom SafeMath Functions

The custom SafeMath library includes several complex functions beyond basic arithmetic, such as sqrrt, percentageAmount, substractPercentage, percentageOfTotal, quadraticPricing, and bondingCurve. The sqrrt function uses an iterative approximation, which could be gas-intensive for very large numbers or if many iterations are required. The percentage calculations (percentageAmount, substractPercentage, percentageOfTotal) use a divisor of 1000 (permille), which might lead to precision loss for small amounts or if higher precision is expected (e.g., standard percentages out of 100).M-01

Issue

The custom SafeMath library includes several complex functions beyond basic arithmetic, such as sqrrt, percentageAmount, substractPercentage, percentageOfTotal, quadraticPricing, and bondingCurve. The sqrrt function uses an iterative approximation, which could be gas-intensive for very large numbers or if many iterations are required. The percentage calculations (percentageAmount, substractPercentage, percentageOfTotal) use a divisor of 1000 (permille), which might lead to precision loss for small amounts or if higher precision is expected (e.g., standard percentages out of 100).

Fix

Thoroughly review and test all custom SafeMath functions for gas efficiency, precision, and correctness against the intended mathematical and economic models. Consider using established libraries for complex mathematical operations if available. Document the expected precision and behavior of percentage calculations.

Status

Unresolved

Low

Lack of Explicit Access Control for Sensitive Base Functions

The _mint and _burn functions in the ERC20 base contract are declared as internal virtual. While this design allows derived contracts to implement them, the ERC20 contract itself does not enforce any access control mechanisms (e.g., onlyOwner, onlyMinterRole) for these critical token supply management operations. Although the AccessControl library is imported, it is not utilized in the provided snippet.L-01

Issue

The _mint and _burn functions in the ERC20 base contract are declared as internal virtual. While this design allows derived contracts to implement them, the ERC20 contract itself does not enforce any access control mechanisms (e.g., onlyOwner, onlyMinterRole) for these critical token supply management operations. Although the AccessControl library is imported, it is not utilized in the provided snippet.

Fix

The derived contract (e.g., ERC20TokenX) must implement robust access control for _mint and _burn functions to prevent unauthorized token creation or destruction. This could involve using OpenZeppelin's AccessControl roles or an Ownable pattern.

Status

Unresolved

Info

Older Solidity Compiler Version (0.7.5)

The contract is compiled with Solidity version 0.7.5. This version does not include native overflow/underflow checks, requiring the use of a custom SafeMath library. Newer Solidity versions (0.8.0 and above) include these checks by default, which can simplify code and reduce reliance on external libraries for basic arithmetic safety. Older compiler versions may also lack recent optimizations or security patches.I-01

Issue

The contract is compiled with Solidity version 0.7.5. This version does not include native overflow/underflow checks, requiring the use of a custom SafeMath library. Newer Solidity versions (0.8.0 and above) include these checks by default, which can simplify code and reduce reliance on external libraries for basic arithmetic safety. Older compiler versions may also lack recent optimizations or security patches.

Fix

Consider upgrading the Solidity compiler version to 0.8.x or higher. This would allow for the removal of the SafeMath library for basic arithmetic operations, simplifying the codebase and leveraging native compiler security features. Ensure thorough testing if upgrading, as there might be minor breaking changes.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The provided code implements a custom ERC20 token with EIP-2612 permit functionality and a custom SafeMath library. The core ERC20 logic largely follows established patterns. However, a critical issue was identified in the EIP-712 DOMAIN_SEPARATOR calculation, which could invalidate permit signatures. Additionally, the custom SafeMath library introduces complexity, and the base contract lacks explicit access control for sensitive token operations.

Technical6/10Medium risk

The technical architecture is based on a standard ERC20 token with EIP-2612 permit extensions. The contract utilizes a custom SafeMath library for arithmetic operations, which is appropriate for Solidity 0.7.5 to prevent overflows/underflows. However, the DOMAIN_SEPARATOR calculation for EIP-712 permit is incomplete, omitting the 'version' string, which is a critical flaw (7.2 Code Security). The custom 'sqrrt' function in SafeMath is an iterative approximation, potentially leading to gas inefficiencies or precision concerns (7.2 Code Security).

Governance2/10High risk

The economic model relies on custom arithmetic functions within SafeMath, such as 'percentageAmount' and 'quadraticPricing', which require careful validation against the intended design (7.4 Economic). The base ERC20 contract does not define explicit access control for '_mint' and '_burn' functions, which are critical for token supply management (7.3 Access Control). While these are 'internal virtual', the derived contract 'ERC20TokenX' must implement robust governance over these functions to prevent unauthorized supply changes.

Upgrades4/10Medium risk

The provided contract code does not implement any proxy patterns or upgrade mechanisms, indicating it is intended to be immutable (7.7 Upgrades). This simplifies the upgrade risk profile, as there are no upgradeability-specific vulnerabilities to consider. Any changes to the token's logic would require a new deployment and migration.

Final RecommendationWhat to do about this score

It is strongly recommended to correct the EIP-712 DOMAIN_SEPARATOR calculation to include the 'version' string, ensuring the 'permit' function operates securely and as intended.

Implement robust access control mechanisms for all sensitive functions, particularly '_mint' and '_burn', in the derived 'ERC20TokenX' contract. Thoroughly review and test the custom SafeMath functions, especially 'sqrrt' and the percentage calculations, for gas efficiency, precision, and adherence to the intended economic model. Consider upgrading to a more recent Solidity compiler version (e.g., 0.8.x) to benefit from native overflow checks and other improvements, reducing reliance on custom SafeMath for basic arithmetic.

Contract & Record

1 audit on record
TypeERC20TokenX
NetworkBNB Chain
Token age1y
Contract0x0833…114e
Deployer0x4e46…370e
Badge for your website
FinTech AI security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202670High
  2. Aug 16, 202668High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Infinity Ground AIAIN · BNB Chain70HighSOCKBNB Chain70HighTopazBNB Chain70HighLitecoin TokenLTC · BNB Chain70HighiShares China Large-Cap ETF (Ondo Tokenized)FXION · BNB Chain70HighAnomaXAN · BNB Chain71High

Would You Like a More Detailed Audit of FinTech AI?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page