Is GUA Safe? Smart Contract Security Analysis

Security Findings

1 Info

Info

Centralized Initial Token Distribution

I-01The contract's constructor mints the entire token supply (1,000,000,000 * 1e18 GUA) to a single `receiver` address. This design choice means that 100% of the token supply is initially controlled by one address (7.4 Economic, 7.8 Operations). While not a direct code vulnerability, this creates a significant centralization point. If the `receiver` address is compromised, or if the entity controlling it acts maliciously, the entire token supply could be at risk or subject to unilateral actions.

IssueThe contract's constructor mints the entire token supply (1,000,000,000 * 1e18 GUA) to a single `receiver` address. This design choice means that 100% of the token supply is initially controlled by one address (7.4 Economic, 7.8 Operations). While not a direct code vulnerability, this creates a significant centralization point. If the `receiver` address is compromised, or if the entity controlling it acts maliciously, the entire token supply could be at risk or subject to unilateral actions.

FixAcknowledge and manage the implications of this centralized distribution. Ensure the `receiver` address is a highly secured multi-signature wallet or a cold storage address with robust access control and operational security procedures. Consider a phased distribution strategy or a vesting schedule if broader decentralization of the token supply is desired in the future.

StatusUnresolved

Category Ratings

TechnicalLow8/10

The GUA contract is a minimal ERC20 implementation, primarily leveraging OpenZeppelin's secure and battle-tested libraries (7.2 Code Security). It introduces no complex custom logic, external calls, or intricate state transitions, significantly reducing the attack surface. Standard ERC20 functions like `transfer` and `approve` are implemented safely. No reentrancy or integer overflow/underflow vulnerabilities were identified due to Solidity 0.8+ default checks and OpenZeppelin's careful use of `unchecked` blocks.

GovernanceHigh1/10

The economic model of the GUA token is straightforward, with a fixed total supply minted entirely to a single `receiver` address during deployment (7.4 Economic). There are no administrative functions for minting, burning (beyond standard internal `_burn`), pausing, or blacklisting post-deployment, which minimizes governance risk (7.5 Governance). The primary economic consideration is the initial centralized distribution of the entire token supply, which places significant control with one entity.

UpgradesMedium6/10

The GUA contract is not designed to be upgradeable (7.7 Upgrades). It is deployed as a standalone, immutable contract. This eliminates risks associated with upgrade mechanisms, such as proxy implementation bugs or insecure upgrade paths, contributing to a stable and predictable contract lifecycle.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

Holder Composition

93.2% in top 10

4.7% in wallets88.5% in contracts

Effective Concentration40.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$7.7K across 2 pairs

UniswapUSDTanalysed$7.6K UniswapUSDT$106

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%

Top-3 Unlocked100.0%

Key Addresses

3 addresses

Deployer

0xa89f…b7bb

Unlocked LP Held By

0x1866…a4970xfacd…2a14

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Top-10 concentration > 30% (93.2% total → 40.1% effective; 4.7% in EOAs, 88.5% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $10k ($7,742 across 2 pairs — easily drained)
LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is GUA Safe?