On-chain security analysis — is it a scam or legit?
BNB ChainThe GUA token contract is a standard ERC20 implementation, inheriting from OpenZeppelin's battle-tested contracts.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x1866…a4970xfacd…2a14No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
receiver address. This design choice means that 100% of the token supply is initially controlled by one address (7.4 Economic, 7.8 Operations). While not a direct code vulnerability, this creates a significant centralization point. If the receiver address is compromised, or if the entity controlling it acts maliciously, the entire token supply could be at risk or subject to unilateral actions.I-01The contract's constructor mints the entire token supply (1,000,000,000 * 1e18 GUA) to a single receiver address. This design choice means that 100% of the token supply is initially controlled by one address (7.4 Economic, 7.8 Operations). While not a direct code vulnerability, this creates a significant centralization point. If the receiver address is compromised, or if the entity controlling it acts maliciously, the entire token supply could be at risk or subject to unilateral actions.
Acknowledge and manage the implications of this centralized distribution. Ensure the receiver address is a highly secured multi-signature wallet or a cold storage address with robust access control and operational security procedures. Consider a phased distribution strategy or a vesting schedule if broader decentralization of the token supply is desired in the future.
Unresolved
The GUA token contract is a standard ERC20 implementation, inheriting from OpenZeppelin's battle-tested contracts. It features a fixed supply minted to a single address upon deployment. The contract's simplicity and reliance on well-audited libraries contribute to a low overall risk profile, with the primary consideration being the centralized initial distribution of tokens.
The GUA contract is a minimal ERC20 implementation, primarily leveraging OpenZeppelin's secure and battle-tested libraries (7.2 Code Security). It introduces no complex custom logic, external calls, or intricate state transitions, significantly reducing the attack surface. Standard ERC20 functions like transfer and approve are implemented safely. No reentrancy or integer overflow/underflow vulnerabilities were identified due to Solidity 0.8+ default checks and OpenZeppelin's careful use of unchecked blocks.
The economic model of the GUA token is straightforward, with a fixed total supply minted entirely to a single receiver address during deployment (7.4 Economic). There are no administrative functions for minting, burning (beyond standard internal _burn), pausing, or blacklisting post-deployment, which minimizes governance risk (7.5 Governance). The primary economic consideration is the initial centralized distribution of the entire token supply, which places significant control with one entity.
The GUA contract is not designed to be upgradeable (7.7 Upgrades). It is deployed as a standalone, immutable contract. This eliminates risks associated with upgrade mechanisms, such as proxy implementation bugs or insecure upgrade paths, contributing to a stable and predictable contract lifecycle.
For the GUA token, ensure the receiver address specified during deployment is secure and controlled by trusted entities, as it will hold the entire initial token supply.
Given the contract's immutability and reliance on OpenZeppelin, no further code-level security enhancements are immediately necessary. Focus on operational security for the receiver address and any off-chain processes interacting with the token.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
