Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Joe Coin Safe?

JOEEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical9/10Governance10/10Upgrades10/10Checks passed7 of 7Findings1 High · 1 Medium · 1 Low · 2 Info5
SummaryAI Copilot

The Joe Token contract is an ERC20 token with custom fee mechanisms and automated liquidity features.

Read the full analysis
What raised the score
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 47 of 7 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockLocked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
15.6%Contracts8.4%76.0%Everyone else
15.6%8.4%76.0%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
24.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking15.6%
  • Walletsanonymous holders, free to sell8.4%
  • Everyone elsethe rest of the supply76.0%
Effective concentrationwhat the score reads14.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.34M across 2 pairs

The risk score reads depth across every pair.

LP tokensLocked

The LP tokens of the analysed pool are locked or burned.

Analysed pool$1.34MShare of depth99.8%
LP Locked100.0% · Null Address, UNCX
Lock Expiry2280 (verified ≥ 1 year) · UNCX V2
Unlocked LP held by
0xb3ac…68a00x826f…1e650x0000…8a900x1f2f…f3870x87c0…36d6

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low2 Info
High

Unchecked Arithmetic in ERC20 Base and Joe Token

The ERC20 base contract's _update function, which is responsible for modifying token balances and total supply, explicitly uses unchecked blocks for addition operations (_balances[to] = _balances[to] + amount; and _totalSupply = _totalSupply + amount;). Similarly, the Joe token's overridden _transfer function may also contain unchecked blocks for balance updates. While Solidity 0.8.x generally provides default overflow/underflow protection, unchecked blocks disable these checks. This could theoretically lead to an integer overflow if _balances[to] or _totalSupply were to exceed type(uint256).max after an addition, resulting in incorrect token balances or total supply.H-01

Issue

The ERC20 base contract's _update function, which is responsible for modifying token balances and total supply, explicitly uses unchecked blocks for addition operations (_balances[to] = _balances[to] + amount; and _totalSupply = _totalSupply + amount;). Similarly, the Joe token's overridden _transfer function may also contain unchecked blocks for balance updates. While Solidity 0.8.x generally provides default overflow/underflow protection, unchecked blocks disable these checks. This could theoretically lead to an integer overflow if _balances[to] or _totalSupply were to exceed type(uint256).max after an addition, resulting in incorrect token balances or total supply.

Fix

Remove the unchecked blocks around addition operations in the _update function and any direct balance manipulations in the _transfer function. Rely on Solidity 0.8.x's default overflow protection. If unchecked is intentionally used for gas optimization, ensure that mathematical invariants are rigorously proven to prevent overflow conditions under all circumstances.

Status

Unresolved

Medium

High and Immutable Transaction Fees

The contract implements a total transaction fee of up to 25% (5% tax, 5% liquidity, 5% burn, 10% marketing). While the ownership has been renounced, making these fee percentages immutable, such a high fixed fee can significantly impact token usability, trading volume, and user perception. It can lead to high price impact on trades, deter legitimate transactions, and potentially reduce the token's overall market appeal and liquidity over time.M-01

Issue

The contract implements a total transaction fee of up to 25% (5% tax, 5% liquidity, 5% burn, 10% marketing). While the ownership has been renounced, making these fee percentages immutable, such a high fixed fee can significantly impact token usability, trading volume, and user perception. It can lead to high price impact on trades, deter legitimate transactions, and potentially reduce the token's overall market appeal and liquidity over time.

Fix

While the fees are immutable due to renounced ownership, it is important for the project to clearly communicate these high fees to potential users and investors. Future token designs should carefully consider the long-term economic impact of such high transaction taxes on user adoption and ecosystem growth.

Status

Unresolved

Low

Lack of Emergency Pause Functionality

The contract lacks a mechanism to pause transfers or other critical functions in case of an emergency, such as a discovered critical bug, exploit, or market manipulation event. While ownership is renounced, preventing a centralized entity from pausing, the absence of any decentralized or community-governed pause mechanism leaves the protocol vulnerable to unmitigated risks in unforeseen circumstances.L-01

Issue

The contract lacks a mechanism to pause transfers or other critical functions in case of an emergency, such as a discovered critical bug, exploit, or market manipulation event. While ownership is renounced, preventing a centralized entity from pausing, the absence of any decentralized or community-governed pause mechanism leaves the protocol vulnerable to unmitigated risks in unforeseen circumstances.

Fix

Consider implementing a decentralized pause mechanism, possibly through a multi-signature wallet or a community governance system, for future contracts. For this deployed contract, acknowledge that no emergency pause is possible and ensure all other security measures are robust.

Status

Unresolved

Info

Potential for Sandwich Attacks on Automated Swaps

The swapAndLiquify function performs automated swaps via Uniswap to manage liquidity. If the swapTokensAtAmount threshold for triggering these swaps is predictable or can be monitored, malicious actors could potentially front-run or sandwich these transactions. This involves placing a transaction before and after the automated swap to profit from the price impact, potentially increasing slippage for the protocol's liquidity addition and reducing its efficiency.I-01

Issue

The swapAndLiquify function performs automated swaps via Uniswap to manage liquidity. If the swapTokensAtAmount threshold for triggering these swaps is predictable or can be monitored, malicious actors could potentially front-run or sandwich these transactions. This involves placing a transaction before and after the automated swap to profit from the price impact, potentially increasing slippage for the protocol's liquidity addition and reducing its efficiency.

Fix

While difficult to fully prevent in public mempools, consider strategies to randomize or obscure the timing of automated swaps in future designs. For the current contract, acknowledge this inherent risk associated with automated liquidity mechanisms interacting with AMMs.

Status

Unresolved

Info

Hardcoded Uniswap V2 Router Address

The Uniswap V2 Router address is hardcoded in the contract's constructor. While this is a common practice and router addresses are generally stable, if the router address were to change or become compromised in the future, the contract's automated liquidity and swap functionalities would cease to work. This would require a new contract deployment to update the address.I-02

Issue

The Uniswap V2 Router address is hardcoded in the contract's constructor. While this is a common practice and router addresses are generally stable, if the router address were to change or become compromised in the future, the contract's automated liquidity and swap functionalities would cease to work. This would require a new contract deployment to update the address.

Fix

For future contracts, consider making critical external contract addresses configurable by a trusted entity (e.g., a multi-sig wallet) or through a governance mechanism, even if ownership is later renounced. For the current contract, this is a known limitation.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The Joe Token contract is an ERC20 token with custom fee mechanisms and automated liquidity features. The audit identified a high-severity issue related to unchecked arithmetic in balance updates within the ERC20 base contract. Other findings include high immutable transaction fees, lack of emergency pause functionality, and informational risks concerning automated swaps and hardcoded addresses. A significant positive is the renounced ownership, which effectively removes many centralization risks associated with owner privileges.

Technical9/10Low risk

The contract implements a standard ERC20 token with custom transfer logic, including various fees and anti-whale mechanisms. A high-severity vulnerability was identified where critical balance updates in the ERC20 base contract's _update function, and potentially in the Joe token's _transfer function, are performed within unchecked blocks, posing a risk of overflow (7.2 Code Security). The architecture is straightforward, integrating with Uniswap V2 for automated liquidity (7.1 Architecture). Access control is well-defined using Ownable, and the renounced ownership significantly mitigates centralization risks (7.3 Access Control).

Governance10/10Low risk

The tokenomics include a significant total transaction fee (up to 25%) which is immutable due to renounced ownership (7.4 Economic). While this prevents malicious changes, it fixes a potentially high barrier for users and could impact trading volume. The anti-whale mechanisms (maxTxPercent, maxWalletPercent) are also fixed. The project benefits from a long-term LP lock, significantly reducing rug pull risk (7.6 External). The renounced ownership eliminates governance risks associated with a single owner (7.5 Governance).

Upgrades10/10Low risk

The contract is not designed with an upgrade mechanism (e.g., proxy pattern), meaning its logic is immutable once deployed (7.7 Upgrades). This eliminates upgrade-related risks such as proxy misconfigurations or malicious upgrades. Any future changes or bug fixes would require a new deployment and migration of assets, which is a standard operational consideration (7.8 Operations).

Final RecommendationWhat to do about this score

It is strongly recommended to review and address the unchecked arithmetic in the _update and _transfer functions to ensure robust overflow protection for all balance modifications.

While uint256 overflows are rare in practice for typical token supplies, explicit checks or removal of unchecked blocks for additions are crucial for maintaining the highest security standards. Additionally, consider the long-term implications of the high, immutable transaction fees on user adoption and trading volume.

Contract & Record

1 audit on record
TypeRouter, Token
NetworkEthereum
Token age2y
Contract0x76e2…49a8
Deployer0x66c6…f7c6
Badge for your website
Joe Coin security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 20260Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
AsteroidEthereum0LowAmerica PacPAC · Ethereum0LowJerry The Turtle By Matt FurieJYAI · Ethereum0LowNon-Playable CoinNPC · Ethereum0LowYee TokenYEE · Ethereum0LowPikachuEthereum0Low

Would You Like a More Detailed Audit of Joe Coin?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page