Is Joe Coin (JOE) Safe? Smart Contract Security Analysis

Security Findings

1 High1 Med1 Low2 Info

High

Unchecked Arithmetic in ERC20 Base and Joe Token

H-01The `ERC20` base contract's `_update` function, which is responsible for modifying token balances and total supply, explicitly uses `unchecked` blocks for addition operations (`_balances[to] = _balances[to] + amount;` and `_totalSupply = _totalSupply + amount;`). Similarly, the `Joe` token's overridden `_transfer` function may also contain `unchecked` blocks for balance updates. While Solidity 0.8.x generally provides default overflow/underflow protection, `unchecked` blocks disable these checks. This could theoretically lead to an integer overflow if `_balances[to]` or `_totalSupply` were to exceed `type(uint256).max` after an addition, resulting in incorrect token balances or total supply.

IssueThe `ERC20` base contract's `_update` function, which is responsible for modifying token balances and total supply, explicitly uses `unchecked` blocks for addition operations (`_balances[to] = _balances[to] + amount;` and `_totalSupply = _totalSupply + amount;`). Similarly, the `Joe` token's overridden `_transfer` function may also contain `unchecked` blocks for balance updates. While Solidity 0.8.x generally provides default overflow/underflow protection, `unchecked` blocks disable these checks. This could theoretically lead to an integer overflow if `_balances[to]` or `_totalSupply` were to exceed `type(uint256).max` after an addition, resulting in incorrect token balances or total supply.

FixRemove the `unchecked` blocks around addition operations in the `_update` function and any direct balance manipulations in the `_transfer` function. Rely on Solidity 0.8.x's default overflow protection. If `unchecked` is intentionally used for gas optimization, ensure that mathematical invariants are rigorously proven to prevent overflow conditions under all circumstances.

StatusUnresolved

Medium

High and Immutable Transaction Fees

M-01The contract implements a total transaction fee of up to 25% (5% tax, 5% liquidity, 5% burn, 10% marketing). While the ownership has been renounced, making these fee percentages immutable, such a high fixed fee can significantly impact token usability, trading volume, and user perception. It can lead to high price impact on trades, deter legitimate transactions, and potentially reduce the token's overall market appeal and liquidity over time.

IssueThe contract implements a total transaction fee of up to 25% (5% tax, 5% liquidity, 5% burn, 10% marketing). While the ownership has been renounced, making these fee percentages immutable, such a high fixed fee can significantly impact token usability, trading volume, and user perception. It can lead to high price impact on trades, deter legitimate transactions, and potentially reduce the token's overall market appeal and liquidity over time.

FixWhile the fees are immutable due to renounced ownership, it is important for the project to clearly communicate these high fees to potential users and investors. Future token designs should carefully consider the long-term economic impact of such high transaction taxes on user adoption and ecosystem growth.

StatusUnresolved

Low

Lack of Emergency Pause Functionality

L-01The contract lacks a mechanism to pause transfers or other critical functions in case of an emergency, such as a discovered critical bug, exploit, or market manipulation event. While ownership is renounced, preventing a centralized entity from pausing, the absence of any decentralized or community-governed pause mechanism leaves the protocol vulnerable to unmitigated risks in unforeseen circumstances.

IssueThe contract lacks a mechanism to pause transfers or other critical functions in case of an emergency, such as a discovered critical bug, exploit, or market manipulation event. While ownership is renounced, preventing a centralized entity from pausing, the absence of any decentralized or community-governed pause mechanism leaves the protocol vulnerable to unmitigated risks in unforeseen circumstances.

FixConsider implementing a decentralized pause mechanism, possibly through a multi-signature wallet or a community governance system, for future contracts. For this deployed contract, acknowledge that no emergency pause is possible and ensure all other security measures are robust.

StatusUnresolved

Info

Potential for Sandwich Attacks on Automated Swaps

I-01The `swapAndLiquify` function performs automated swaps via Uniswap to manage liquidity. If the `swapTokensAtAmount` threshold for triggering these swaps is predictable or can be monitored, malicious actors could potentially front-run or sandwich these transactions. This involves placing a transaction before and after the automated swap to profit from the price impact, potentially increasing slippage for the protocol's liquidity addition and reducing its efficiency.

IssueThe `swapAndLiquify` function performs automated swaps via Uniswap to manage liquidity. If the `swapTokensAtAmount` threshold for triggering these swaps is predictable or can be monitored, malicious actors could potentially front-run or sandwich these transactions. This involves placing a transaction before and after the automated swap to profit from the price impact, potentially increasing slippage for the protocol's liquidity addition and reducing its efficiency.

FixWhile difficult to fully prevent in public mempools, consider strategies to randomize or obscure the timing of automated swaps in future designs. For the current contract, acknowledge this inherent risk associated with automated liquidity mechanisms interacting with AMMs.

StatusUnresolved

Info

Hardcoded Uniswap V2 Router Address

I-02The Uniswap V2 Router address is hardcoded in the contract's constructor. While this is a common practice and router addresses are generally stable, if the router address were to change or become compromised in the future, the contract's automated liquidity and swap functionalities would cease to work. This would require a new contract deployment to update the address.

IssueThe Uniswap V2 Router address is hardcoded in the contract's constructor. While this is a common practice and router addresses are generally stable, if the router address were to change or become compromised in the future, the contract's automated liquidity and swap functionalities would cease to work. This would require a new contract deployment to update the address.

FixFor future contracts, consider making critical external contract addresses configurable by a trusted entity (e.g., a multi-sig wallet) or through a governance mechanism, even if ownership is later renounced. For the current contract, this is a known limitation.

StatusUnresolved

Category Ratings

TechnicalLow9/10

The contract implements a standard ERC20 token with custom transfer logic, including various fees and anti-whale mechanisms. A high-severity vulnerability was identified where critical balance updates in the `ERC20` base contract's `_update` function, and potentially in the `Joe` token's `_transfer` function, are performed within `unchecked` blocks, posing a risk of overflow (7.2 Code Security). The architecture is straightforward, integrating with Uniswap V2 for automated liquidity (7.1 Architecture). Access control is well-defined using `Ownable`, and the renounced ownership significantly mitigates centralization risks (7.3 Access Control).

GovernanceLow10/10

The tokenomics include a significant total transaction fee (up to 25%) which is immutable due to renounced ownership (7.4 Economic). While this prevents malicious changes, it fixes a potentially high barrier for users and could impact trading volume. The anti-whale mechanisms (`maxTxPercent`, `maxWalletPercent`) are also fixed. The project benefits from a long-term LP lock, significantly reducing rug pull risk (7.6 External). The renounced ownership eliminates governance risks associated with a single owner (7.5 Governance).

UpgradesLow10/10

The contract is not designed with an upgrade mechanism (e.g., proxy pattern), meaning its logic is immutable once deployed (7.7 Upgrades). This eliminates upgrade-related risks such as proxy misconfigurations or malicious upgrades. Any future changes or bug fixes would require a new deployment and migration of assets, which is a standard operational consideration (7.8 Operations).

Security Checklist

5/5 checks passed

Contract VerifiedPass

Ownership RenouncedPass

No Mint FunctionPass

Liquidity LockedPass

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

24.0% in top 10

8.4% in wallets15.6% in contracts

Effective Concentration14.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.34M across 2 pairs

Uniswap v2WETHanalysed$1.34M Uniswap v3WETH$3.2K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Locked100.0% · Null Address, UNCX

Lock Expiry2280 (verified ≥ 1 year) · UNCX V2

Key Addresses

6 addresses

Deployer

0x66c6…f7c6

Unlocked LP Held By

0xb3ac…68a00x826f…1e650x0000…8a900x1f2f…f3870x87c0…36d6

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors

1 High finding(s) from audit
1 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Joe Coin Safe?

Security Findings

Unchecked Arithmetic in ERC20 Base and Joe Token

High and Immutable Transaction Fees

Lack of Emergency Pause Functionality

Potential for Sandwich Attacks on Automated Swaps

Hardcoded Uniswap V2 Router Address

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Joe Coin?