Early-stage security check — honeypot & rug-pull analysis
BNB ChainThis audit covers the OpenZeppelin Address utility library, a foundational component providing essential low-level address interaction functions.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xb94f…5030No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
isContract Limitations for Security ChecksisContract function, while useful, has known limitations as explicitly stated in its NatSpec. It returns false for contracts in construction, destroyed contracts, or EOAs, and can be circumvented by calling from a contract constructor. It is explicitly warned against using it to protect against flash loan attacks or to prevent calls from contracts due to composability issues (7.2 Code Security).I-01The isContract function, while useful, has known limitations as explicitly stated in its NatSpec. It returns false for contracts in construction, destroyed contracts, or EOAs, and can be circumvented by calling from a contract constructor. It is explicitly warned against using it to protect against flash loan attacks or to prevent calls from contracts due to composability issues (7.2 Code Security).
Developers should not rely on isContract as a primary security mechanism to distinguish between EOAs and contracts or to prevent specific types of attacks (e.g., flash loans). Instead, robust access control, reentrancy guards, and careful state management should be employed.
Unresolved
sendValuesendValue function, which uses a low-level call to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not used carefully. Control is transferred to the recipient, allowing them to re-enter the calling contract before its state is updated (7.2 Code Security).I-02The sendValue function, which uses a low-level call to transfer Ether, explicitly warns about the potential for reentrancy vulnerabilities if not used carefully. Control is transferred to the recipient, allowing them to re-enter the calling contract before its state is updated (7.2 Code Security).
When using sendValue or any low-level call that transfers value, developers must strictly adhere to the checks-effects-interactions pattern. Implement reentrancy guards (e.g., OpenZeppelin's ReentrancyGuard) on functions that perform external calls and modify state.
Unresolved
Address library provides several functionCall variants for performing low-level call, staticcall, and delegatecall. While these functions include checks for call success and revert reasons, their misuse in a calling contract can lead to unexpected behavior, reentrancy, or incorrect state updates. delegatecall in particular carries significant risk if the target contract is not trusted or properly vetted, as it executes code in the context of the calling contract (7.2 Code Security).I-03The Address library provides several functionCall variants for performing low-level call, staticcall, and delegatecall. While these functions include checks for call success and revert reasons, their misuse in a calling contract can lead to unexpected behavior, reentrancy, or incorrect state updates. delegatecall in particular carries significant risk if the target contract is not trusted or properly vetted, as it executes code in the context of the calling contract (7.2 Code Security).
Developers integrating functionCall, functionStaticCall, or functionDelegateCall must thoroughly understand the implications of low-level calls. Ensure the target contract is trusted, input data is validated, and the calling contract's logic correctly handles potential reentrancy or state changes resulting from the external call. delegatecall should only be used with extreme caution and only with fully trusted and audited implementation contracts.
Unresolved
This audit covers the OpenZeppelin Address utility library, a foundational component providing essential low-level address interaction functions. The code is highly robust and well-tested, with explicit warnings regarding potential misuse patterns. No direct vulnerabilities were found within the library itself; findings are informational, highlighting best practices for integration.
The Address library (7.1 Architecture) demonstrates excellent code security (7.2 Code Security) and adherence to best practices. It provides robust functions for low-level calls and address checks, with clear warnings about potential reentrancy in sendValue and limitations of isContract. The library itself is well-tested (7.6 External) and does not implement direct access control (7.3 Access Control), relying on calling contracts for such logic.
As a foundational utility library, Address.sol does not incorporate specific economic mechanisms (7.4 Economic) or governance structures (7.5 Governance). Its impact on a protocol's economics or governance is indirect, depending entirely on how it is integrated and utilized by higher-level contracts.
The Address library is a standalone utility and is not designed for direct upgradeability (7.7 Upgrades) in the same manner as a proxy contract. Its immutability ensures consistent behavior for all contracts that link to it. Any changes would require redeployment and updates to all dependent contracts, which is a standard practice for foundational libraries.
Developers integrating the OpenZeppelin Address library should meticulously review its internal documentation and warnings.
Particular attention must be paid to the safe usage of sendValue to prevent reentrancy, and the limitations of isContract for security-critical decisions. Always apply the checks-effects-interactions pattern and consider using reentrancy guards when performing external calls that transfer value or interact with untrusted contracts.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
