Is Invesqo QQQ (QQQB) Safe? Smart Contract Security Analysis

Security Findings

1 Crit1 Med1 Low1 Info

Critical

Missing Zero Address Check for Admin Role in `initialize`

C-01The `initialize` function, which sets up the initial `DEFAULT_ADMIN_ROLE`, does not validate that the `admin_` parameter is not the zero address (`address(0)`). If `address(0)` is provided during initialization, the `DEFAULT_ADMIN_ROLE` will be granted to the zero address, making it impossible to manage roles, enable/disable minting/burning, or perform any other administrative functions. This would lead to a permanent lockout of administrative control over the contract.

IssueThe `initialize` function, which sets up the initial `DEFAULT_ADMIN_ROLE`, does not validate that the `admin_` parameter is not the zero address (`address(0)`). If `address(0)` is provided during initialization, the `DEFAULT_ADMIN_ROLE` will be granted to the zero address, making it impossible to manage roles, enable/disable minting/burning, or perform any other administrative functions. This would lead to a permanent lockout of administrative control over the contract.

FixAdd a check in the `initialize` function to ensure `admin_` is not `address(0)` before granting the `DEFAULT_ADMIN_ROLE`. For example: `if (admin_ == address(0)) revert ZeroAddress();`

StatusUnresolved

Medium

Missing Zero Address Checks for External Client Contracts

M-01The `initialize` function accepts `compliance_` and `pauseManager_` addresses for external client contracts without validating that these addresses are not the zero address (`address(0)`). While not directly leading to a loss of funds, setting these critical external dependencies to `address(0)` could result in unexpected runtime errors, non-functional compliance checks, or an inability to pause the token, severely impacting the contract's intended behavior and operational stability.

IssueThe `initialize` function accepts `compliance_` and `pauseManager_` addresses for external client contracts without validating that these addresses are not the zero address (`address(0)`). While not directly leading to a loss of funds, setting these critical external dependencies to `address(0)` could result in unexpected runtime errors, non-functional compliance checks, or an inability to pause the token, severely impacting the contract's intended behavior and operational stability.

FixImplement zero-address checks for `compliance_` and `pauseManager_` parameters in the `initialize` function. For example: `if (compliance_ == address(0)) revert ZeroAddress();` and `if (pauseManager_ == address(0)) revert ZeroAddress();`

StatusUnresolved

Low

High Centralization Risk with DEFAULT_ADMIN_ROLE

L-01The `DEFAULT_ADMIN_ROLE` holds extensive power over the `SecuritiesToken` contract. This role can set the token's name, symbol, and identifier, enable/disable minting and burning, and grant/revoke any other role, including the `ISSUER_ROLE`. While common for security tokens requiring centralized control, this concentration of power means that a compromise of the single entity holding the `DEFAULT_ADMIN_ROLE` could lead to significant operational and economic risks, including unauthorized token issuance or manipulation of token metadata.

IssueThe `DEFAULT_ADMIN_ROLE` holds extensive power over the `SecuritiesToken` contract. This role can set the token's name, symbol, and identifier, enable/disable minting and burning, and grant/revoke any other role, including the `ISSUER_ROLE`. While common for security tokens requiring centralized control, this concentration of power means that a compromise of the single entity holding the `DEFAULT_ADMIN_ROLE` could lead to significant operational and economic risks, including unauthorized token issuance or manipulation of token metadata.

FixConsider implementing a multi-signature wallet or a time-locked governance mechanism for the `DEFAULT_ADMIN_ROLE` to distribute control and introduce a delay for critical operations. This would enhance security by requiring multiple approvals for sensitive actions and providing a window for intervention.

StatusUnresolved

Info

Reliance on External Compliance and Pause Managers

I-01The `SecuritiesToken` contract integrates `ComplianceClientUpgradeable` and `PauseManagerClientUpgradeable`, making its core functionalities (transfers, minting, burning) dependent on the logic and availability of these external contracts. The security, reliability, and upgradeability of these external dependencies are paramount, as any vulnerability or malfunction in them could directly impact the `SecuritiesToken`'s operations and user experience.

IssueThe `SecuritiesToken` contract integrates `ComplianceClientUpgradeable` and `PauseManagerClientUpgradeable`, making its core functionalities (transfers, minting, burning) dependent on the logic and availability of these external contracts. The security, reliability, and upgradeability of these external dependencies are paramount, as any vulnerability or malfunction in them could directly impact the `SecuritiesToken`'s operations and user experience.

FixEnsure that the external `ComplianceClientUpgradeable` and `PauseManagerClientUpgradeable` contracts are thoroughly audited, well-maintained, and controlled by robust governance mechanisms. Implement monitoring for these external contracts to detect any unusual behavior or potential compromises promptly.

StatusUnresolved

Category Ratings

TechnicalMedium4/10

The contract leverages OpenZeppelin's upgradeable patterns and AccessControlEnumerable for robust role management (7.1 Architecture, 7.3 Access Control). Custom error types enhance readability and debugging (7.2 Code Security). However, a critical flaw exists in the `initialize` function where the `admin_` address is not validated against the zero address, potentially leading to an unrecoverable loss of administrative control (7.3 Access Control). Additionally, external compliance and pause manager addresses lack zero-address checks, which could cause operational issues (7.6 External).

GovernanceHigh1/10

The token's economic model relies on a centralized `DEFAULT_ADMIN_ROLE` for critical operations such as enabling/disabling minting/burning, and managing all other roles (7.4 Economic, 7.5 Governance). This centralization, while common for security tokens, introduces a single point of failure. The contract's functionality is also heavily dependent on external Compliance and Pause Manager contracts, whose security and governance directly impact the token's transferability and availability (7.6 External).

UpgradesHigh1/10

The contract correctly implements OpenZeppelin's upgradeable proxy pattern, utilizing `_disableInitializers()` in the constructor and the `initializer` modifier for the `initialize` function (7.7 Upgrades). This approach minimizes the risk of re-initialization and ensures proper deployment within a proxy architecture. No apparent storage collision risks or other upgrade-specific vulnerabilities were identified in the provided code snippet.

Security Checklist

1/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeBeacon

ImplementationVerified source

Holder Composition

81.7% in top 10

71.4% in wallets10.3% in contracts

Effective Concentration75.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$2.95M across 9 pairs

Pancakeswap v3USDTanalysed$2.52M UniswapUSDC$315.3K Pancakeswap v3WBNB$48.3K Pancakeswap v2WBNB$33.8K Pancakeswap v3USDT$29.3K TopazUSDT$4.4K

Show 3 more pairsShow less

Pancakeswap v2USDT$3.3K UniswapUSDT$1 Pancakeswap v3USDC$1

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder42.1%

Top-3 Unlocked78.4%

Key Addresses

11 addresses

Deployer

0x64fd…8d53

Unlocked LP Held By

0x2f7d…5ef00x556b…d59e0x7b87…b51e0x64fd…2f280x97d2…f1820xde6a…c0550xb46b…224e0xc37e…87e10xe7d2…371b0x1fee…ed6f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

10 factors

Ownership status UNKNOWN (owner could not be resolved)
Mintable supply — no cap found, dilution unbounded
Proxy contract (upgradeable — admin can replace logic)
Complex proxy pattern (BEACON)
Top-10 concentration > 70% (81.7% total → 75.5% effective; 71.4% in EOAs, 10.3% in contracts — extreme)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Token age < 30 days (still settling)
1 Critical finding(s) from audit
1 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Invesqo QQQ Safe?

Security Findings

Missing Zero Address Check for Admin Role in `initialize`

Missing Zero Address Checks for External Client Contracts

High Centralization Risk with DEFAULT_ADMIN_ROLE

Reliance on External Compliance and Pause Managers

Category Ratings

Security Checklist

Proxy Upgrade Controls

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Frequently Asked Questions

Related Audits

Would You Like a More Detailed Audit of Invesqo QQQ?