Quantum Audit Logo

Is MatthewCoin a Scam?

Early-stage security check — honeypot & rug-pull analysis

Is this your token? Publish your own audit on this page →

MatthewCoin MATTHEWCOIN
0xad5b…ffff
BNB Chain Not verifiedLast checked 3d ago 1 audit on record New Launch · 1d old
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

This audit covers the `Address.sol` utility library from OpenZeppelin Contracts. This library provides essential low-level address interaction functions, including safe ETH transfers and robust wrappers for `call`, `delegatecall`, and `staticcall`. As a widely used and thoroughly audited component of the OpenZeppelin suite, the contract itself exhibits high security standards and best practices. The identified findings are informational, highlighting common pitfalls and security considerations for developers integrating this library into their own contracts, rather than vulnerabilities within the library itself.

3 Informational
! Early-stage analysis. This token has limited on-chain history (1d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.
Volume 24h
$2.7K
Liquidity
$13.6K
Price
$0.00001215
Token Age
1d
Top 10 Holders
73.0%

Security Findings

3 Info
Info

Misuse of `isContract` for Security Checks

I-01The `isContract` function, while useful, has limitations explicitly noted in its documentation. It is unsafe to assume that an address for which this function returns `false` is an externally-owned account (EOA). Furthermore, `isContract` should not be relied upon to protect against flash loan attacks or to prevent calls from contracts, as it can be circumvented (e.g., by calling from a contract constructor). This is a common misunderstanding that can lead to access control bypasses or unexpected behavior (7.2 Code Security, 7.3 Access Control).
IssueThe `isContract` function, while useful, has limitations explicitly noted in its documentation. It is unsafe to assume that an address for which this function returns `false` is an externally-owned account (EOA). Furthermore, `isContract` should not be relied upon to protect against flash loan attacks or to prevent calls from contracts, as it can be circumvented (e.g., by calling from a contract constructor). This is a common misunderstanding that can lead to access control bypasses or unexpected behavior (7.2 Code Security, 7.3 Access Control).
FixAvoid using `isContract` as a primary security mechanism to distinguish between EOAs and contracts, or to prevent flash loan attacks. Instead, implement robust access control mechanisms (e.g., `Ownable`, role-based access control) and reentrancy guards where necessary. If distinguishing between EOAs and contracts is critical, consider alternative, more robust methods or acknowledge the inherent limitations.
StatusUnresolved
Info

Reentrancy Risk with External ETH Transfers

I-02The `sendValue` function, while a safer alternative to `transfer`, explicitly warns that 'control is transferred to `recipient`, care must be taken to not create reentrancy vulnerabilities.' This highlights a critical security consideration for any contract performing external ETH transfers. If the recipient is a malicious contract, it can re-enter the calling contract before its state is updated, leading to potential fund drains (7.2 Code Security).
IssueThe `sendValue` function, while a safer alternative to `transfer`, explicitly warns that 'control is transferred to `recipient`, care must be taken to not create reentrancy vulnerabilities.' This highlights a critical security consideration for any contract performing external ETH transfers. If the recipient is a malicious contract, it can re-enter the calling contract before its state is updated, leading to potential fund drains (7.2 Code Security).
FixAlways adhere to the 'checks-effects-interactions' pattern when performing external calls, especially those involving value transfers. Update all relevant state variables *before* initiating any external calls. Consider using a reentrancy guard (e.g., OpenZeppelin's `ReentrancyGuard`) for functions that perform external calls and modify critical state.
StatusUnresolved
Info

Risks Associated with Low-Level Calls

I-03The library provides wrappers for low-level `call`, `delegatecall`, and `staticcall` functions (e.g., `functionCallWithValue`, `functionDelegateCall`). While these wrappers include important safety checks (like `success` verification and error bubbling), the inherent risks of low-level calls remain. Incorrect `data` parameters, calls to untrusted contracts, or unexpected re-entrancy from the called contract can lead to vulnerabilities, even with these wrappers. `delegatecall` is particularly powerful and risky, as it executes code in the context of the calling contract (7.2 Code Security, 7.6 External).
IssueThe library provides wrappers for low-level `call`, `delegatecall`, and `staticcall` functions (e.g., `functionCallWithValue`, `functionDelegateCall`). While these wrappers include important safety checks (like `success` verification and error bubbling), the inherent risks of low-level calls remain. Incorrect `data` parameters, calls to untrusted contracts, or unexpected re-entrancy from the called contract can lead to vulnerabilities, even with these wrappers. `delegatecall` is particularly powerful and risky, as it executes code in the context of the calling contract (7.2 Code Security, 7.6 External).
FixExercise extreme caution when using low-level call functions. Ensure that the target address is trusted and that the `data` payload is correctly formatted and validated. For `delegatecall`, only use it with trusted, audited implementation contracts. Implement robust error handling and consider the potential for reentrancy or unexpected state changes in the calling contract due to external interactions.
StatusUnresolved

Category Ratings

TechnicalLow10/10

The `Address` library (7.1 Architecture) is a foundational utility from OpenZeppelin, designed to provide safer interactions with addresses and low-level calls. It includes functions like `sendValue` for robust ETH transfers and `functionCallWithValue` for secure external contract interactions, mitigating common risks associated with raw `call` operations (7.2 Code Security). The library itself does not implement specific access control (7.3 Access Control) but provides tools that calling contracts can use securely. Its code quality is exceptionally high, with clear documentation and adherence to best practices, making it a reliable component for EVM development.

GovernanceMedium4/10

This contract is a utility library and does not implement any specific governance mechanisms (7.5 Governance) or economic models (7.4 Economic). Therefore, governance and economic risks are not applicable to this component directly. Its security relies on the robust design and extensive auditing by the OpenZeppelin team and the broader community.

UpgradesLow9/10

As a Solidity library, `Address.sol` is typically deployed as immutable bytecode and linked at compile time or used via `delegatecall` in proxy patterns. It is not designed for direct upgradeability (7.7 Upgrades) in the same way a contract implementing business logic would be. Any updates to the library would require redeploying dependent contracts or updating proxy implementations to reference a new library address. Therefore, upgrade safety concerns are not directly applicable to the library itself.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

73.0% in top 10
14.8% in wallets58.2% in contracts
Effective Concentration38.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$13.6K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder97.9%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0x051a…c508
Unlocked LP Held By
0x11ce…cb740x0ae3…18b7

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors
  • Top-10 concentration > 30% (73.0% total → 38.0% effective; 14.8% in EOAs, 58.2% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k ($13,604 across 1 pairs — thin market)
  • LP top1 unlocked holder = 97.9% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • Token age < 7 days (early, volatile)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Billion Zone Xchange (ZBX)Medium RiskElonCoinMedium RiskTokenFi (TOKEN)Medium RiskBaby Asteroid (BABYASTEROID)Medium RiskDecentrawood (DEOD)Medium Riskast.fun (AST)Medium Risk

Would You Like a More Detailed Audit of MatthewCoin?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit