Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is MindNetwork FHE Token Safe?

FHEBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance5/10Upgrades6/10Checks passed3 of 5Findings1 High · 1 Medium · 1 Low3
SummaryAI Copilot

The FHE token contract is an ERC20 token utilizing OpenZeppelin's battle-tested libraries for core token functionality, access control, burning, and permit features.

Read the full analysis
What raised the score
  • Mintable supply, capped at 32%/year
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 94.8%
  • LP top3 unlocked holders = 97.7%
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Mintable supply, capped at 32%/year
  • Top-10 concentration > 30% (80.7% total → 47.8% effective; 25.9% in EOAs, 54.8% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 94.8% (independent LP — depth risk, pool = 97% of DEX liquidity)
  • LP top3 unlocked holders = 97.7% (independent LP — depth risk, pool = 97% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
54.8%Contracts25.9%Wallets19.3%Everyone else
54.8%Contracts25.9%Wallets19.3%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
80.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking54.8%
  • Walletsanonymous holders, free to sell25.9%
  • Everyone elsethe rest of the supply19.3%
Effective concentrationwhat the score reads47.8%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$984.4K across 5 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$954.6KShare of depth97.0%
Top-1 Unlocked Holder94.8%
Top-3 Unlocked97.7%
Unlocked LP held by
0xdff6…7faa0x5f27…0ae60xbee2…ef090x966d…e41a0xa7af…c3ee0x19bc…de510xd79f…f4700x1e8c…131a0xb16b…01350x10f1…7832

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low
High

Centralized Control of Critical Roles

The DEFAULT_ADMIN_ROLE holds significant power, including the ability to grant and revoke the MINTER_ROLE and to change the ccipAdmin address. Initially, this role is assigned to the contract deployer (msg.sender). A compromise of this single address could lead to unauthorized token minting (up to maxSupply), manipulation of administrative settings, and potential economic instability for the token. (7.3 Access Control, 7.4 Economic, 7.8 Operations)H-01

Issue

The DEFAULT_ADMIN_ROLE holds significant power, including the ability to grant and revoke the MINTER_ROLE and to change the ccipAdmin address. Initially, this role is assigned to the contract deployer (msg.sender). A compromise of this single address could lead to unauthorized token minting (up to maxSupply), manipulation of administrative settings, and potential economic instability for the token. (7.3 Access Control, 7.4 Economic, 7.8 Operations)

Fix

It is strongly recommended to transfer the DEFAULT_ADMIN_ROLE to a robust multi-signature wallet or a decentralized autonomous organization (DAO) governance contract immediately after deployment. This distributes control and significantly reduces the single point of failure risk.

Status

Unresolved

Medium

Unused ccipAdmin Role

The ccipAdmin state variable and its setter function setCCIPAdmin are implemented, allowing the DEFAULT_ADMIN_ROLE to change this address. However, the ccipAdmin variable is not utilized anywhere within the provided FHE contract code. This introduces an unnecessary administrative function and state variable, potentially leading to confusion about its purpose or creating an unused attack vector if its intended external use is not properly secured. (7.1 Architecture, 7.8 Operations)M-01

Issue

The ccipAdmin state variable and its setter function setCCIPAdmin are implemented, allowing the DEFAULT_ADMIN_ROLE to change this address. However, the ccipAdmin variable is not utilized anywhere within the provided FHE contract code. This introduces an unnecessary administrative function and state variable, potentially leading to confusion about its purpose or creating an unused attack vector if its intended external use is not properly secured. (7.1 Architecture, 7.8 Operations)

Fix

Clarify the intended purpose and usage of the ccipAdmin variable. If it is meant for an external system, ensure that system's security model is robust and integrated. If it has no current or future use, consider removing the variable and its associated functions to reduce contract complexity and potential attack surface.

Status

Unresolved

Low

Lack of Explicit Renouncement Mechanism for MINTER_ROLE

While the DEFAULT_ADMIN_ROLE can grant and revoke the MINTER_ROLE, there is no explicit function within the FHE contract for an account holding the MINTER_ROLE to renounce it themselves. Although AccessControl provides a general renounceRole function, it requires the callerConfirmation parameter, which might not be intuitive for all users. An explicit function or clear documentation for MINTER_ROLE holders to step down could improve operational clarity and reduce potential attack surface if a minter's key is compromised and they wish to remove their privileges proactively. (7.3 Access Control, 7.8 Operations)L-01

Issue

While the DEFAULT_ADMIN_ROLE can grant and revoke the MINTER_ROLE, there is no explicit function within the FHE contract for an account holding the MINTER_ROLE to renounce it themselves. Although AccessControl provides a general renounceRole function, it requires the callerConfirmation parameter, which might not be intuitive for all users. An explicit function or clear documentation for MINTER_ROLE holders to step down could improve operational clarity and reduce potential attack surface if a minter's key is compromised and they wish to remove their privileges proactively. (7.3 Access Control, 7.8 Operations)

Fix

Consider adding a specific renounceMinterRole() function that calls _revokeRole(MINTER_ROLE, _msgSender()) or provide clear documentation on how MINTER_ROLE holders can use the inherited renounceRole function to step down.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The FHE token contract is an ERC20 token utilizing OpenZeppelin's battle-tested libraries for core token functionality, access control, burning, and permit features. The contract implements a fixed maximum supply and a centralized minting mechanism controlled by a MINTER_ROLE. While the code quality is high and relies on robust external components, the significant power vested in the DEFAULT_ADMIN_ROLE and MINTER_ROLE presents a centralized control risk. Additionally, an unused administrative variable introduces minor complexity.

Technical7/10Low risk

The contract is built upon well-audited OpenZeppelin libraries (ERC20, AccessControl, ERC20Burnable, ERC20Permit), which significantly reduces the risk of common technical vulnerabilities. Custom logic is minimal, primarily involving a mint function with a maxSupply check and a setCCIPAdmin function. The mint function correctly enforces the maxSupply limit, preventing unbounded inflation (7.2 Code Security). No reentrancy or integer overflow/underflow vulnerabilities were identified due to the use of Solidity 0.8.x and OpenZeppelin's robust implementations (7.2 Code Security).

Governance5/10Medium risk

The economic model features a fixed maxSupply for the FHE token, providing a clear cap on total inflation. However, the MINTER_ROLE has the ability to mint tokens up to this maximum, introducing a centralized point of control over token supply (7.4 Economic). The DEFAULT_ADMIN_ROLE holds extensive power, including the ability to grant and revoke the MINTER_ROLE and manage the ccipAdmin address (7.3 Access Control). There is no on-chain governance mechanism implemented, meaning all administrative decisions and role changes are controlled by addresses holding these specific roles (7.5 Governance).

Upgrades6/10Medium risk

The FHE token contract is not designed as an upgradeable proxy. Therefore, there are no upgrade-specific risks such as proxy initialization issues, storage collisions, or logic inconsistencies between proxy and implementation contracts (7.7 Upgrades). Any future changes to the contract logic would require a new deployment and migration of assets.

Final RecommendationWhat to do about this score

To enhance the security and decentralization of the FHE token, it is crucial to implement robust management for critical administrative roles.

Transferring the DEFAULT_ADMIN_ROLE to a multi-signature wallet or a DAO governance system immediately after deployment will significantly mitigate the risk associated with a single point of failure. Additionally, clearly define and document the purpose of the ccipAdmin variable, or remove it if it serves no function within the current scope, to reduce unnecessary complexity and potential attack surface.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age1y
Contract0xd55c…727e
Deployer0x9f82…65d5
Badge for your website
MindNetwork FHE Token security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202641Medium
  2. Aug 11, 202622Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the FHE contract address?

The MindNetwork FHE Token (FHE) contract on BNB Chain is 0xd55c9fb62e176a8eb6968f32958fefdd0962727e. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is MindNetwork FHE Token a scam?

Quantum Audit's risk score for MindNetwork FHE Token is 41/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is FHE liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $984.4K.

Who holds FHE?

As of Sep 4, 2026, the 10 largest holders own 80.7% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Baby Doge CoinBABYDOGE · BNB Chain41MediumOrochi Network TokenON · BNB Chain41MediumTermMaxTMX · BNB Chain41MediumStrikeBitSTRIKE · BNB Chain41MediumZestBNB Chain42MediumAPRO oracle TokenAT · BNB Chain40Medium

Would You Like a More Detailed Audit of MindNetwork FHE Token?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page