On-chain security analysis — is it a scam or legit?
EthereumThe OBI contract is an ERC-20 token implementation utilizing OpenZeppelin's AccessControl.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 15, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xe41b…6c4cThe contract lets its controller — an owner that could not be resolved — change any holder's balance (seize or credit tokens). Nothing independent vouches for whoever holds them, so each is a live risk to holders.
Check who holds these powers and whether a timelock or multisig stands between them and holders.
Acknowledged
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0xe41b…6c4c — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint capability, holder concentration) were applied separately and feed the risk score.
Re-check after any contract upgrade or ownership change, both of which can alter behaviour without changing this page.
Acknowledged
The ten largest holders own 74.8% of supply. What remains: 3.5% in wallets, 71.3% in other contracts. 1,225 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Orbofi AI (OBI), market cap $2M, rank #2398. 1,225 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $36K (DexScreener, all pools). 24h trading volume $999K (CoinGecko, all markets, daily snapshot). 24h trading volume $107K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.0848 on 2023-05-29; the price is now 98.5427% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $36K of DEX liquidity across 1 pools. Launch: 1171 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The OBI contract is an ERC-20 token implementation utilizing OpenZeppelin's AccessControl. The audit found no critical, high, or medium severity vulnerabilities. The contract's core functionality appears robust, though it deviates from the full ERC-20 standard by omitting totalSupply(), balanceOf(address), and allowance(address,address).
The OBI contract implements a token with AccessControl (7.1 Architecture). It includes standard ERC-20 transfer functions (transfer, transferFrom, approve) but notably omits totalSupply(), balanceOf(address), and allowance(address,address), which are part of the ERC-20 standard. The code security (7.2 Code Security) appears sound, with no reentrancy or integer issues identified in the provided functions. Access control (7.3 Access Control) is well-defined, restricting setBurnerRole and revokeBurnerRole to the DEFAULT_ADMIN_ROLE.
The contract's economic model (7.4 Economic) is straightforward, based on a standard token with no complex DeFi primitives. Governance (7.5 Governance) is managed through OpenZeppelin's AccessControl, where a DEFAULT_ADMIN_ROLE can grant and revoke the BURNER_ROLE using setBurnerRole and revokeBurnerRole. This centralized control over burner roles is a standard and transparent pattern, ensuring clear administrative oversight. No external dependencies (7.6 External) introduce significant governance or economic risks.
The OBI contract is not deployed as a proxy (7.7 Upgrades) and therefore does not support upgradeability. This eliminates risks associated with proxy patterns, such as storage collisions or upgrade path vulnerabilities. The contract's immutability ensures its logic remains constant post-deployment.
Ensure that the omission of standard ERC-20 functions (totalSupply, balanceOf, allowance) is intentional and compatible with all intended integrations.
Conduct thorough testing of all administrative functions, particularly those related to role management, to confirm they operate as expected under various scenarios. Implement robust operational procedures (7.8 Operations) for managing the DEFAULT_ADMIN_ROLE to prevent unauthorized access or misuse.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
