On-chain security analysis — is it a scam or legit?
PolygonThe UChildERC20 contract functions as a bridge-compatible token on Polygon.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 29, 2026
The 18 remaining pairs hold $394 between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xa5c8…070e0x440b…fefe0x2d08…c39b0xd188…dcf50x4360…6b7a0x001b…a4bd0x7c29…7e2f0x4d28…52e30x6412…ab680x4b95…ba2cNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The contract can receive ETH through meta-transactions or direct transfers but lacks a withdrawal function to move these funds out, leading to permanent loss of any ETH sent to the contract address.
Implement a function that allows the owner to withdraw any ETH accidentally sent to the contract.
Unresolved
The deposit function allows addresses with the DEPOSITOR_ROLE to mint new tokens, which increases the total supply and dilutes existing holders. This is a powerful administrative privilege.
Restrict the DEPOSITOR_ROLE to a multi-signature wallet or a time-locked contract to prevent single-point-of-failure risks.
Unresolved
0.0% of the pool's LP is burned or time-locked. 59.4% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 49% of the token's DEX liquidity; the other pools were not assessed.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 40.1% of supply. Of that, 19.6% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 15.3% in wallets, 5.3% in other contracts. 29,274 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Lido DAO (LDO), market cap $302M, rank #137. Traded on Binance. 29,274 holders. Verified by: CoinGecko, exchange listings.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $161K (DexScreener, all pools). 24h trading volume $37.9M (CoinGecko, all markets, daily snapshot). 24h trading volume $73K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $7.30 on 2021-08-20; the price is now 95.0136% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $161K of DEX liquidity across 28 pools. Launch: 1699 days of market history.
Check how much of the voting supply insiders hold and what governance can change.
Acknowledged
The UChildERC20 contract functions as a bridge-compatible token on Polygon. It utilizes standard OpenZeppelin access control and proxy patterns. While the core ERC-20 logic is standard, the contract contains centralized minting capabilities and a lack of mechanisms to recover accidentally sent ETH, which are common in bridge-token implementations.
The architecture follows standard proxy patterns (7.1) and utilizes well-vetted OpenZeppelin libraries for access control (7.3). Code security (7.2) is high due to the use of established standards, though the lack of ETH recovery (7.8) is a functional oversight. External dependencies (7.6) are minimal and well-integrated.
Economic risk (7.4) is centered on the minting authority held by the DEPOSITOR_ROLE. Governance (7.5) is centralized, allowing the owner or designated roles to influence supply. This is typical for bridge tokens but represents a trust-based risk for holders.
The contract utilizes a proxy pattern (7.7) allowing for logic updates. Upgrades are managed via standard administrative roles, ensuring a controlled path for maintenance. No issues were identified in the upgrade implementation logic.
The protocol should implement a 'sweep' function to allow the owner to recover accidentally sent ETH, preventing permanent loss of funds.
Additionally, the minting authority should be monitored via multi-signature wallets or timelocks to mitigate the risk of unauthorized supply inflation.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Lido DAO Token (PoS) (LDO) contract on Polygon is 0xc3c7d422809852031b44ab29eec9f1eff2a58756. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Lido DAO Token (PoS) is 34/100 (Low risk) as of Oct 29, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 29, 2026). Total DEX liquidity: $160.8K.
As of Oct 29, 2026, the 10 largest holders own 40.1% of the supply across 29,274 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
