Quantum Audit Logo

Is OWB Safe?

On-chain security analysis — is it a scam or legit?

OWB OWB
0xef59…b3c1
Base Not verifiedLast checked 3d ago 2 audits on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The audit of the Token contract, a mock ERC20 implementation with owner-controlled minting, identified a Medium overall risk level. The contract is well-structured, leveraging battle-tested OpenZeppelin libraries, which contributes to its technical robustness. The primary risks stem from the centralized control over token supply via the owner's minting capability and the associated operational security requirements for the owner's private key. No critical code vulnerabilities were found.

1 High1 Low1 Informational
Volume 24h
$21.4K
Liquidity
$67.9K
Price
$0.01136
Token Age
9mo
Top 10 Holders
72.2%

Security Findings

1 High1 Low1 Info
High

Owner Key Compromise Leads to Supply Manipulation

H-01The `Token` contract grants the `owner` exclusive control over the `mint` function, allowing arbitrary inflation of the token supply. If the owner's private key is compromised, an attacker could mint an unlimited number of tokens, severely devaluing the asset and causing significant economic damage. This represents a single point of failure for the token's economic integrity (7.3 Access Control, 7.4 Economic, 7.8 Operations).
IssueThe `Token` contract grants the `owner` exclusive control over the `mint` function, allowing arbitrary inflation of the token supply. If the owner's private key is compromised, an attacker could mint an unlimited number of tokens, severely devaluing the asset and causing significant economic damage. This represents a single point of failure for the token's economic integrity (7.3 Access Control, 7.4 Economic, 7.8 Operations).
FixImplement robust security measures for the owner's private key, such as a hardware security module (HSM) or a multi-signature wallet. For production systems, consider a time-locked mechanism or a governance-controlled minting process to mitigate the risk of a single point of failure or malicious action.
StatusUnresolved
Low

Irreversible Loss of Owner Privileges

L-01The `renounceOwnership` function allows the current owner to permanently relinquish ownership of the contract by transferring it to `address(0)`. If this function is called without a plan for re-establishing control or if it's done accidentally, all `onlyOwner` functions, including `mint`, will become permanently inaccessible (7.8 Operations).
IssueThe `renounceOwnership` function allows the current owner to permanently relinquish ownership of the contract by transferring it to `address(0)`. If this function is called without a plan for re-establishing control or if it's done accidentally, all `onlyOwner` functions, including `mint`, will become permanently inaccessible (7.8 Operations).
FixExercise extreme caution when using `renounceOwnership`. Ensure that renouncing ownership is an intentional and well-understood action, typically only performed when the contract is designed to be immutable after deployment or when control is transferred to a governance mechanism.
StatusUnresolved
Info

EIP-2612 Permit Signature Replay Considerations

I-01The contract utilizes `ERC20Permit` (EIP-2612) for gasless approvals. While the OpenZeppelin implementation correctly uses nonces to prevent on-chain replay of signatures, users should be aware that off-chain signature replay attacks are still possible if a signed permit message is broadcast multiple times by different relayers before it's processed on-chain (7.2 Code Security).
IssueThe contract utilizes `ERC20Permit` (EIP-2612) for gasless approvals. While the OpenZeppelin implementation correctly uses nonces to prevent on-chain replay of signatures, users should be aware that off-chain signature replay attacks are still possible if a signed permit message is broadcast multiple times by different relayers before it's processed on-chain (7.2 Code Security).
FixUsers should be educated on the mechanics of EIP-2612 and the importance of using unique signatures for each transaction. Relay services should implement robust mechanisms to prevent replaying signatures.
StatusUnresolved

Category Ratings

TechnicalLow7/10

The Token contract exhibits high technical quality, primarily due to its reliance on battle-tested OpenZeppelin libraries for ERC20, ERC20Permit, ERC20Burnable, and Ownable functionalities (7.2 Code Security). Custom logic is minimal and correctly implemented, specifically the `mint` function which is properly restricted to the owner (7.3 Access Control). No reentrancy, integer overflow/underflow, or other common EVM vulnerabilities were identified in the custom code.

GovernanceLow8/10

The contract's economic model is highly centralized, with the owner possessing absolute control over the token supply through the `mint` function (7.4 Economic). This design, while intended for a 'mock USDC', introduces a significant single point of failure: a compromise of the owner's private key would allow an attacker to mint unlimited tokens, severely impacting the token's value and trust (7.3 Access Control). Robust operational security for the owner's key is paramount to mitigate this inherent risk (7.8 Operations).

UpgradesLow7/10

The contract is not designed as an upgradeable proxy, meaning its core logic cannot be changed post-deployment (7.7 Upgrades). While the `Ownable` pattern allows for administrative control transfer via `transferOwnership`, this does not facilitate code upgrades. The risk related to upgrades is therefore minimal, as the contract's functionality is fixed.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionFail
Liquidity LockedPass
Not a ProxyPass

Holder Composition

72.2% in top 10
8.6% in wallets63.7% in contracts
Effective Concentration34.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$134.1K across 6 pairs
AerodromeUSDCanalysed$67.9K50.6%Uniswap v3USDC$47.5K35.4%Uniswap v4USDC$9.5K7.0%Uniswap v3USDC$6.4K4.7%Uniswap v4USDC$2.8K2.1%AerodromeWETH$920.1%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Locked100.0% · UNCX Locker

Key Addresses

2 addresses
Deployer
0x8fed…1e0e
Unlocked LP Held By
0x5a01…a692

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

4 factors
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (72.2% total → 34.0% effective; 8.6% in EOAs, 63.7% in contracts — moderate)
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is OWB a scam?

Based on automated analysis, OWB scores 66/100 (High Risk) on our risk scale. No honeypot was detected, but always verify independently before investing.

Is OWB safe to buy?

Our scanner flagged a risk score of 66/100. Ownership has not been renounced, which is a risk factor. DYOR before purchasing any token.

Has OWB been audited?

The contract has not been verified on-chain. Verification is not the same as a full security audit. Use Quantum Audit's free tool to run a deeper analysis of the contract code.

Related Audits

6 more on the record
FlowerMedium RiskBitVault Signal (BV7X)Medium RiskMoltbook (MOLT)Medium RiskKellyClaudeMedium RiskOpenAIMedium RiskGoogle T-REX (TREX)Medium Risk

Would You Like a More Detailed Audit of OWB?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit