Quantum Audit Logo

Is Play Safe?

On-chain security analysis — is it a scam or legit?

Play PLAY
0x853a…f841
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The SimpleToken contract is a basic ERC20 token implementation, inheriting directly from OpenZeppelin's well-audited ERC20 contract. It provides standard token functionalities without additional complex logic or external integrations. The contract is not upgradeable and has no special access control roles beyond the initial token distribution. The overall risk is low due to its simplicity and reliance on battle-tested OpenZeppelin libraries.

3 Informational
Volume 24h
$5.34M
Liquidity
$450.4K
Price
$0.03584
Token Age
3mo
Top 10 Holders
95.0%

Security Findings

3 Info
Info

Initial Token Supply Centralization

I-01The entire initial token supply (`totalSupply_`) is minted to a single `owner` address during the `SimpleToken` contract's deployment. While this is a common pattern for initial token distribution, it centralizes the entire supply in one address at launch. This `owner` address will hold all tokens until they are distributed further.
IssueThe entire initial token supply (`totalSupply_`) is minted to a single `owner` address during the `SimpleToken` contract's deployment. While this is a common pattern for initial token distribution, it centralizes the entire supply in one address at launch. This `owner` address will hold all tokens until they are distributed further.
FixEnsure the `owner` address used for initial minting is highly secured, preferably a multi-signature wallet or a well-audited contract, to prevent a single point of failure or compromise. Plan for a decentralized distribution strategy post-deployment.
StatusUnresolved
Info

Lack of Emergency Controls

I-02The `SimpleToken` contract does not include any mechanisms for pausing transfers or blacklisting malicious addresses. While this design choice promotes decentralization and immutability, it removes the ability for the project team to mitigate severe issues such as exploits, stolen funds, or regulatory compliance requirements through emergency actions.
IssueThe `SimpleToken` contract does not include any mechanisms for pausing transfers or blacklisting malicious addresses. While this design choice promotes decentralization and immutability, it removes the ability for the project team to mitigate severe issues such as exploits, stolen funds, or regulatory compliance requirements through emergency actions.
FixEvaluate the project's risk tolerance and potential scenarios where emergency controls might be necessary. If such controls are deemed critical, consider implementing a pausable mechanism (e.g., OpenZeppelin's `Pausable` contract) or a role-based blacklist, understanding that these introduce a degree of centralization.
StatusUnresolved
Info

Fixed Decimals Value

I-03The `decimals()` function in the `ERC20` base contract is hardcoded to return `18`. This is a widely adopted standard for ERC20 tokens, but it means the token's decimal precision cannot be altered post-deployment. If a different precision is ever required, a new token contract would need to be deployed.
IssueThe `decimals()` function in the `ERC20` base contract is hardcoded to return `18`. This is a widely adopted standard for ERC20 tokens, but it means the token's decimal precision cannot be altered post-deployment. If a different precision is ever required, a new token contract would need to be deployed.
FixConfirm that a fixed decimal value of 18 is suitable for all current and future use cases of the token. If flexibility in decimal precision is a potential requirement, this design choice should be noted.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The technical architecture (7.1) is robust, leveraging the battle-tested OpenZeppelin ERC20 standard. Code security (7.2) is high due to the use of `unchecked` blocks for arithmetic where appropriate and comprehensive input validation, preventing common integer overflow/underflow issues and invalid address usage. Access control (7.3) is minimal, limited to standard ERC20 permissions, with no additional roles or privileged functions. The contract adheres to ERC20 standards and best practices for secure token implementation.

GovernanceHigh1/10

The economic model (7.4) is a simple fixed-supply token after initial minting, with no complex mechanisms, fees, or staking. Governance (7.5) is not present within the contract itself, as it's a basic token. The initial distribution mints all tokens to a single owner, which is a common but centralized starting point. External interactions (7.6) are non-existent, reducing attack surface.

UpgradesMedium6/10

The contract (7.7) is not designed to be upgradeable, meaning its logic is immutable once deployed. This eliminates upgrade-related risks such as proxy misconfigurations or logic errors during upgrades, but also prevents future modifications or bug fixes without a full redeployment. Operations (7.8) are straightforward, with no complex off-chain dependencies.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

95.0% in top 10
24.5% in wallets70.5% in contracts
Effective Concentration52.7%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$719.9K across 10 pairs
PancakeswapUSDCanalysed$450.4K62.6%AerodromeUSDC$133.0K18.5%PancakeswapUSDC$88.6K12.3%AerodromeUSDC$32.8K4.6%PancakeswapUSDC$8.7K1.2%Uniswap v3USDC$3.7K0.5%
Show 4 more pairsShow less
Uniswap v4USDC$1.5K0.2%Uniswap v4USDC$1.1K0.2%Uniswap v4USDC$1570.0%Hydrex CLAMMUSDC$60.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.7%
Top-3 Unlocked100.0%

Key Addresses

7 addresses
Deployer
0x9e39…92d2
Unlocked LP Held By
0x8815…288b0xe7c4…a2850x08ad…eed80xff07…95390x0879…b2290x7963…0305

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 50% (95.0% total → 52.7% effective; 24.5% in EOAs, 70.5% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10× (11.8× — possible wash trading)
  • LP top1 unlocked holder = 99.7% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
The Stonks Exchange (STONKEX)Medium RiskBasehatMedium RiskOpalMedium Riskaixbt by Virtuals (AIXBT)Medium RiskOpenGradient (OPG)Medium RiskZoraMedium Risk

Would You Like a More Detailed Audit of Play?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit