Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is MYX Safe?

BNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical9/10Governance3/10Upgrades6/10Checks passed3 of 5Findings1 High · 1 Low · 2 Info4
SummaryAI Copilot

The MYX token contract is a straightforward ERC20 implementation leveraging battle-tested OpenZeppelin libraries for its core functionality and ERC20Permit extension.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 30% (88.1% total → 41.5% effective; 10.3% in EOAs, 77.8% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
77.8%Contracts10.3%Wallets11.9%Everyone else
77.8%Contracts10.3%11.9%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
88.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking77.8%
  • Walletsanonymous holders, free to sell10.3%
  • Everyone elsethe rest of the supply11.9%
Effective concentrationwhat the score reads41.5%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$274.5K across 10 pairs
Show 4 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$240.5KShare of depth87.6%
Top-1 Unlocked Holder28.1%
Top-3 Unlocked55.0%
Unlocked LP held by
0x0266…24130x467b…71320x7226…46bc0xd34d…c1ab0x7b0d…145c0xd601…ea770x0ae4…103b0x3262…f28a0xa86d…dfc30xef7c…22c2

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Low2 Info
High

Centralization of Token Supply

The entire MAX_SUPPLY of MYX tokens (1,000,000,000 ether) is minted to a single _DISTRIBUTOR address (0x3E1D…b293) in the contract's constructor. This design choice creates a single point of failure for the entire token supply (7.4 Economic, 7.8 Operations). If the _DISTRIBUTOR address's private key is compromised, or if the address itself is a contract with a vulnerability, the entire token supply could be stolen or frozen, leading to a catastrophic loss for the project and its users.H-01

Issue

The entire MAX_SUPPLY of MYX tokens (1,000,000,000 ether) is minted to a single _DISTRIBUTOR address () in the contract's constructor. This design choice creates a single point of failure for the entire token supply (7.4 Economic, 7.8 Operations). If the _DISTRIBUTOR address's private key is compromised, or if the address itself is a contract with a vulnerability, the entire token supply could be stolen or frozen, leading to a catastrophic loss for the project and its users.

Fix

Implement robust security measures for the _DISTRIBUTOR address. This could include using a hardware wallet, a multi-signature wallet (e.g., Gnosis Safe), or a time-locked contract for managing the token distribution. Consider distributing the initial supply across multiple secure addresses or implementing a more decentralized distribution mechanism if feasible for future token projects.

Status

Unresolved

Low

Front-running Risk for Permit Function

The permit function, while a standard and useful feature from EIP-2612, can be susceptible to front-running (7.2 Code Security). A malicious actor could observe a user's signed permit message in the mempool and submit their own transaction with a higher gas price, effectively 'stealing' the user's intended approval or causing the legitimate transaction to fail and incur unnecessary gas costs. This is an inherent characteristic of the permit pattern and not a flaw in the contract's implementation itself.L-01

Issue

The permit function, while a standard and useful feature from EIP-2612, can be susceptible to front-running (7.2 Code Security). A malicious actor could observe a user's signed permit message in the mempool and submit their own transaction with a higher gas price, effectively 'stealing' the user's intended approval or causing the legitimate transaction to fail and incur unnecessary gas costs. This is an inherent characteristic of the permit pattern and not a flaw in the contract's implementation itself.

Fix

Educate users about the potential for front-running when using the permit function. Advise them to be cautious when broadcasting signed messages and to consider using private transaction relays or services that offer front-running protection if available on the network.

Status

Unresolved

Info

Reliance on Battle-Tested OpenZeppelin Libraries

The MYX contract extensively uses OpenZeppelin's ERC20 and ERC20Permit implementations. These libraries are widely recognized as industry standards, have undergone numerous audits, and are battle-tested in production environments (7.2 Code Security). This significantly reduces the likelihood of common vulnerabilities such as reentrancy, integer overflows/underflows, or incorrect ERC20 behavior within the core token logic.I-01

Issue

The MYX contract extensively uses OpenZeppelin's ERC20 and ERC20Permit implementations. These libraries are widely recognized as industry standards, have undergone numerous audits, and are battle-tested in production environments (7.2 Code Security). This significantly reduces the likelihood of common vulnerabilities such as reentrancy, integer overflows/underflows, or incorrect ERC20 behavior within the core token logic.

Fix

Continue to monitor OpenZeppelin's security advisories and updates. Ensure that the specific versions of OpenZeppelin contracts used are up-to-date and free from known vulnerabilities.

Status

Unresolved

Info

Fixed Token Supply and Immutability

The MYX token has a fixed MAX_SUPPLY of 1 billion tokens (with 18 decimals) and no additional minting or burning capabilities beyond the initial constructor mint (7.4 Economic). The contract is also not upgradeable (7.7 Upgrades). This design provides transparency and predictability regarding the total token supply and ensures that the contract's logic remains immutable post-deployment.I-02

Issue

The MYX token has a fixed MAX_SUPPLY of 1 billion tokens (with 18 decimals) and no additional minting or burning capabilities beyond the initial constructor mint (7.4 Economic). The contract is also not upgradeable (7.7 Upgrades). This design provides transparency and predictability regarding the total token supply and ensures that the contract's logic remains immutable post-deployment.

Fix

This is a design choice. Ensure that the fixed supply and immutability align with the long-term economic and operational goals of the MYX project. Clearly communicate these characteristics to the community.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The MYX token contract is a straightforward ERC20 implementation leveraging battle-tested OpenZeppelin libraries for its core functionality and ERC20Permit extension. The primary security concern identified is the centralization of the entire token supply to a single distributor address, which presents a significant single point of failure. The contract is not upgradeable, eliminating upgrade-related risks but also limiting future flexibility. Overall, the technical implementation is robust due to OpenZeppelin's foundations, but the economic model introduces a notable centralization risk.

Technical9/10Low risk

The MYX token contract is simple and primarily relies on battle-tested OpenZeppelin ERC20 and ERC20Permit implementations (7.2 Code Security). This significantly reduces the risk of common token vulnerabilities like reentrancy or integer overflows, as OpenZeppelin contracts are rigorously audited. The implementation correctly handles ERC20 standard functions and the EIP-2612 permit mechanism. A minor technical consideration is the inherent front-running risk associated with the permit function (7.2 Code Security), where a signed message could be observed and exploited by a malicious actor.

Governance3/10High risk

The token has a fixed maximum supply, providing transparency and predictability regarding its total issuance (7.4 Economic). There are no complex economic models or governance mechanisms introduced by the contract itself, simplifying its economic profile. However, a significant economic and operational risk is the complete centralization of the token supply (7.4 Economic, 7.8 Operations). All MAX_SUPPLY tokens are minted to a single _DISTRIBUTOR address in the constructor, making this address a single point of failure. Compromise of this address would jeopardize the entire token supply.

Upgrades6/10Medium risk

The contract is not designed to be upgradeable, which eliminates all risks associated with upgrade mechanisms, such as proxy implementation bugs, storage collisions, or improper upgrade paths (7.7 Upgrades). This provides a fixed and immutable contract logic. As the contract is not upgradeable, any discovered vulnerabilities or desired feature enhancements would require a new deployment and migration, which can be a complex and costly process.

Final RecommendationWhat to do about this score

It is strongly recommended to implement robust security measures for the _DISTRIBUTOR address, such as a multi-signature wallet or a time-locked contract, to mitigate the significant centralization risk.

Users of the permit function should be aware of potential front-running and consider using transaction monitoring or private transaction services if applicable. Given the immutability, thorough pre-deployment testing and verification are paramount.

Contract & Record

1 audit on record
TypeToken
NetworkBNB Chain
Token age1y
Contract0xd825…3e16
Deployer0x8eeb…f45b
Badge for your website
MYX security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 11, 202630Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
AsterBNB Chain30LowBluwhale AIBLUAI · BNB Chain30LowTaleXX · BNB Chain30LowPeaqOFTPEAQ · BNB Chain30Low施工猫SUE · BNB Chain30LowVELLORAVELL · BNB Chain30Low

Would You Like a More Detailed Audit of MYX?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page