Early-stage security check — honeypot & rug-pull analysis
BNB ChainThe SecuritiesToken is a highly configurable, upgradeable ERC-20 token designed for regulated securities.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 21, 2026
The 20 remaining pairs hold $142.4K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x93af…631b0xacd6…2a340xae47…3d800x7380…8b980x4067…2c670xa598…2cd70x7ef2…854b0xae02…294e0xf155…2d6e0xf248…164eNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The functions setPauseManager and setCompliance allow administrators to replace the external contracts that govern token transfers. Because transfers depend on these external contracts, an administrator can effectively halt or redirect the flow of tokens at will.
Restrict these functions to a multi-signature wallet or a time-locked governance contract to prevent unilateral changes.
Unresolved
The setUIMultiplier function allows privileged roles to change the fee structure applied to token transfers. This gives administrators the ability to modify the economic cost of using the token without prior notice to users.
Implement a delay or a public notification period before fee changes take effect to protect users from sudden economic shifts.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 9 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 41% of the token's DEX liquidity; the other pools were not assessed.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The setUIMultiplier function also controls numeric limits that affect transaction or wallet sizes. Administrators can adjust these thresholds, potentially restricting or enabling specific user behaviors.
Document the intended range for these limits and ensure that any changes are communicated transparently to the community.
Unresolved
The ten largest holders own 99.2% of supply. Of that, 8.2% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 60.6% in wallets, 30.3% in other contracts. 585 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
585 holders. Not listed by CoinGecko or any exchange GoPlus tracks. Nothing independent confirms who is behind this token, so every power its contract grants is scored at face value.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $392K (DexScreener, all pools). 24h trading volume $1.7M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $392K of DEX liquidity across 30 pools. Launch: under a day of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
The SecuritiesToken is a highly configurable, upgradeable ERC-20 token designed for regulated securities. It utilizes a beacon proxy pattern and extensive role-based access control to manage compliance, pause states, and token parameters. While the architecture is modular, the high degree of administrative control over core token logic introduces significant centralization risks.
The contract follows standard OpenZeppelin upgradeable patterns (7.1 Architecture). Code security is robust, utilizing well-audited libraries for access control and ERC-20 compliance (7.2 Code Security). The reliance on external compliance and pause manager contracts allows for flexible regulatory updates (7.6 External). However, the logic is heavily dependent on these external addresses, which are mutable by privileged roles.
Governance is strictly centralized under role-based access control (7.3 Access Control, 7.5 Governance). Administrators have the power to alter token economics, including fees and multipliers (7.4 Economic). This design is intentional for securities compliance but represents a single point of failure for token holders.
The protocol uses a Beacon Proxy pattern, allowing for efficient implementation updates (7.7 Upgrades). Operations are managed through standard administrative roles (7.8 Operations). While this facilitates maintenance, it requires high trust in the administrative keys to prevent malicious logic injection.
Implement a multi-signature wallet or a time-locked governance contract to manage the administrative roles.
This will mitigate the risk of a single compromised key unilaterally altering compliance logic or token parameters. Ensure that the external contracts linked via setCompliance and setPauseManager are also subject to rigorous security audits and are managed through similar multi-signature or decentralized governance processes.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The KraneShares STAR Market 50 ETF (KSTRB) contract on BNB Chain is 0x5f1668b592cdf695b0c8e643a5a0078bb94cd80c. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for KraneShares STAR Market 50 ETF is 84/100 (High risk) as of Oct 21, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 21, 2026). Total DEX liquidity: $392.5K.
As of Oct 21, 2026, the 10 largest holders own 99.2% of the supply across 585 holders. The Holders section on this page shows who they are by holder type.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
