Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is MatthewCoin a Scam?

MATTHEWCOINBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on recordNew Launch · 1d old
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance4/10Upgrades9/10Checks passed4 of 5Findings3 Info3
SummaryAI Copilot

This audit covers the Address.sol utility library from OpenZeppelin Contracts.

Read the full analysis
What raised the score
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k
  • LP top1 unlocked holder = 97.9%
  • LP top3 unlocked holders = 100.0%
  • Token age < 7 days
Exact factors
  • Top-10 concentration > 30% (73.0% total → 38.0% effective; 14.8% in EOAs, 58.2% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k ($13,604 across 1 pairs — thin market)
  • LP top1 unlocked holder = 97.9% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • Token age < 7 days (early, volatile)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (1d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 44 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
58.2%Contracts14.8%Wallets27.0%Everyone else
58.2%Contracts14.8%Wallets27.0%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
73.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking58.2%
  • Walletsanonymous holders, free to sell14.8%
  • Everyone elsethe rest of the supply27.0%
Effective concentrationwhat the score reads38.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$13.6K

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$13.6KShare of depth100.0%
Top-1 Unlocked Holder97.9%
Top-3 Unlocked100.0%
Unlocked LP held by
0x11ce…cb740x0ae3…18b7

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 Info
Info

Misuse of isContract for Security Checks

The isContract function, while useful, has limitations explicitly noted in its documentation. It is unsafe to assume that an address for which this function returns false is an externally-owned account (EOA). Furthermore, isContract should not be relied upon to protect against flash loan attacks or to prevent calls from contracts, as it can be circumvented (e.g., by calling from a contract constructor). This is a common misunderstanding that can lead to access control bypasses or unexpected behavior (7.2 Code Security, 7.3 Access Control).I-01

Issue

The isContract function, while useful, has limitations explicitly noted in its documentation. It is unsafe to assume that an address for which this function returns false is an externally-owned account (EOA). Furthermore, isContract should not be relied upon to protect against flash loan attacks or to prevent calls from contracts, as it can be circumvented (e.g., by calling from a contract constructor). This is a common misunderstanding that can lead to access control bypasses or unexpected behavior (7.2 Code Security, 7.3 Access Control).

Fix

Avoid using isContract as a primary security mechanism to distinguish between EOAs and contracts, or to prevent flash loan attacks. Instead, implement robust access control mechanisms (e.g., Ownable, role-based access control) and reentrancy guards where necessary. If distinguishing between EOAs and contracts is critical, consider alternative, more robust methods or acknowledge the inherent limitations.

Status

Unresolved

Info

Reentrancy Risk with External ETH Transfers

The sendValue function, while a safer alternative to transfer, explicitly warns that 'control is transferred to recipient, care must be taken to not create reentrancy vulnerabilities.' This highlights a critical security consideration for any contract performing external ETH transfers. If the recipient is a malicious contract, it can re-enter the calling contract before its state is updated, leading to potential fund drains (7.2 Code Security).I-02

Issue

The sendValue function, while a safer alternative to transfer, explicitly warns that 'control is transferred to recipient, care must be taken to not create reentrancy vulnerabilities.' This highlights a critical security consideration for any contract performing external ETH transfers. If the recipient is a malicious contract, it can re-enter the calling contract before its state is updated, leading to potential fund drains (7.2 Code Security).

Fix

Always adhere to the 'checks-effects-interactions' pattern when performing external calls, especially those involving value transfers. Update all relevant state variables *before* initiating any external calls. Consider using a reentrancy guard (e.g., OpenZeppelin's ReentrancyGuard) for functions that perform external calls and modify critical state.

Status

Unresolved

Info

Risks Associated with Low-Level Calls

The library provides wrappers for low-level call, delegatecall, and staticcall functions (e.g., functionCallWithValue, functionDelegateCall). While these wrappers include important safety checks (like success verification and error bubbling), the inherent risks of low-level calls remain. Incorrect data parameters, calls to untrusted contracts, or unexpected re-entrancy from the called contract can lead to vulnerabilities, even with these wrappers. delegatecall is particularly powerful and risky, as it executes code in the context of the calling contract (7.2 Code Security, 7.6 External).I-03

Issue

The library provides wrappers for low-level call, delegatecall, and staticcall functions (e.g., functionCallWithValue, functionDelegateCall). While these wrappers include important safety checks (like success verification and error bubbling), the inherent risks of low-level calls remain. Incorrect data parameters, calls to untrusted contracts, or unexpected re-entrancy from the called contract can lead to vulnerabilities, even with these wrappers. delegatecall is particularly powerful and risky, as it executes code in the context of the calling contract (7.2 Code Security, 7.6 External).

Fix

Exercise extreme caution when using low-level call functions. Ensure that the target address is trusted and that the data payload is correctly formatted and validated. For delegatecall, only use it with trusted, audited implementation contracts. Implement robust error handling and consider the potential for reentrancy or unexpected state changes in the calling contract due to external interactions.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit covers the Address.sol utility library from OpenZeppelin Contracts. This library provides essential low-level address interaction functions, including safe ETH transfers and robust wrappers for call, delegatecall, and staticcall. As a widely used and thoroughly audited component of the OpenZeppelin suite, the contract itself exhibits high security standards and best practices. The identified findings are informational, highlighting common pitfalls and security considerations for developers integrating this library into their own contracts, rather than vulnerabilities within the library itself.

Technical10/10Low risk

The Address library (7.1 Architecture) is a foundational utility from OpenZeppelin, designed to provide safer interactions with addresses and low-level calls. It includes functions like sendValue for robust ETH transfers and functionCallWithValue for secure external contract interactions, mitigating common risks associated with raw call operations (7.2 Code Security). The library itself does not implement specific access control (7.3 Access Control) but provides tools that calling contracts can use securely. Its code quality is exceptionally high, with clear documentation and adherence to best practices, making it a reliable component for EVM development.

Governance4/10Medium risk

This contract is a utility library and does not implement any specific governance mechanisms (7.5 Governance) or economic models (7.4 Economic). Therefore, governance and economic risks are not applicable to this component directly. Its security relies on the robust design and extensive auditing by the OpenZeppelin team and the broader community.

Upgrades9/10Low risk

As a Solidity library, Address.sol is typically deployed as immutable bytecode and linked at compile time or used via delegatecall in proxy patterns. It is not designed for direct upgradeability (7.7 Upgrades) in the same way a contract implementing business logic would be. Any updates to the library would require redeploying dependent contracts or updating proxy implementations to reference a new library address. Therefore, upgrade safety concerns are not directly applicable to the library itself.

Final RecommendationWhat to do about this score

The Address.sol library is a robust and well-audited component.

Developers integrating this library should carefully review the explicit warnings within its documentation regarding potential misuse, particularly concerning reentrancy and the limitations of isContract. Always follow the checks-effects-interactions pattern when performing external calls, even when using the library's safe wrappers. Ensure that any contract utilizing these low-level call functions properly handles return values and potential reverts to maintain overall system security.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age1d
Contract0xad5b…ffff
Deployer0x051a…c508
Badge for your website
MatthewCoin security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202628Low
  2. Aug 12, 202623Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Billion Zone XchangeZBX · BNB Chain28LowElonCoinBNB Chain28LowTokenFiTOKEN · BNB Chain28LowCloudBankCOD · BNB Chain28LowETH Fan Token EcosystemEFT · BNB Chain28LowGiggle HeroGIGGLEHERO · BNB Chain28Low

Would You Like a More Detailed Audit of MatthewCoin?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page