Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Play Safe?

PLAYBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades6/10Checks passed3 of 5Findings3 Info3
SummaryAI Copilot

The SimpleToken contract is a basic ERC20 token implementation, inheriting directly from OpenZeppelin's well-audited ERC20 contract.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10×
  • LP top1 unlocked holder = 99.7%
  • LP top3 unlocked holders = 100.0%
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 50% (95.0% total → 52.7% effective; 24.5% in EOAs, 70.5% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10× (11.8× — possible wash trading)
  • LP top1 unlocked holder = 99.7% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
70.5%Contracts24.5%Wallets5.0%Everyone else
70.5%Contracts24.5%Wallets5.0%
ContractsWalletsEveryone elseBubble area = share of supply
95.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking70.5%
  • Walletsanonymous holders, free to sell24.5%
  • Everyone elsethe rest of the supply5.0%
Effective concentrationwhat the score reads52.7%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$719.9K across 10 pairs
Show 4 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$450.4KShare of depth62.6%
Top-1 Unlocked Holder99.7%
Top-3 Unlocked100.0%
Unlocked LP held by
0x8815…288b0xe7c4…a2850x08ad…eed80xff07…95390x0879…b2290x7963…0305

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 Info
Info

Initial Token Supply Centralization

The entire initial token supply (totalSupply_) is minted to a single owner address during the SimpleToken contract's deployment. While this is a common pattern for initial token distribution, it centralizes the entire supply in one address at launch. This owner address will hold all tokens until they are distributed further.I-01

Issue

The entire initial token supply (totalSupply_) is minted to a single owner address during the SimpleToken contract's deployment. While this is a common pattern for initial token distribution, it centralizes the entire supply in one address at launch. This owner address will hold all tokens until they are distributed further.

Fix

Ensure the owner address used for initial minting is highly secured, preferably a multi-signature wallet or a well-audited contract, to prevent a single point of failure or compromise. Plan for a decentralized distribution strategy post-deployment.

Status

Unresolved

Info

Lack of Emergency Controls

The SimpleToken contract does not include any mechanisms for pausing transfers or blacklisting malicious addresses. While this design choice promotes decentralization and immutability, it removes the ability for the project team to mitigate severe issues such as exploits, stolen funds, or regulatory compliance requirements through emergency actions.I-02

Issue

The SimpleToken contract does not include any mechanisms for pausing transfers or blacklisting malicious addresses. While this design choice promotes decentralization and immutability, it removes the ability for the project team to mitigate severe issues such as exploits, stolen funds, or regulatory compliance requirements through emergency actions.

Fix

Evaluate the project's risk tolerance and potential scenarios where emergency controls might be necessary. If such controls are deemed critical, consider implementing a pausable mechanism (e.g., OpenZeppelin's Pausable contract) or a role-based blacklist, understanding that these introduce a degree of centralization.

Status

Unresolved

Info

Fixed Decimals Value

The decimals() function in the ERC20 base contract is hardcoded to return 18. This is a widely adopted standard for ERC20 tokens, but it means the token's decimal precision cannot be altered post-deployment. If a different precision is ever required, a new token contract would need to be deployed.I-03

Issue

The decimals() function in the ERC20 base contract is hardcoded to return 18. This is a widely adopted standard for ERC20 tokens, but it means the token's decimal precision cannot be altered post-deployment. If a different precision is ever required, a new token contract would need to be deployed.

Fix

Confirm that a fixed decimal value of 18 is suitable for all current and future use cases of the token. If flexibility in decimal precision is a potential requirement, this design choice should be noted.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The SimpleToken contract is a basic ERC20 token implementation, inheriting directly from OpenZeppelin's well-audited ERC20 contract. It provides standard token functionalities without additional complex logic or external integrations. The contract is not upgradeable and has no special access control roles beyond the initial token distribution. The overall risk is low due to its simplicity and reliance on battle-tested OpenZeppelin libraries.

Technical8/10Low risk

The technical architecture (7.1) is robust, leveraging the battle-tested OpenZeppelin ERC20 standard. Code security (7.2) is high due to the use of unchecked blocks for arithmetic where appropriate and comprehensive input validation, preventing common integer overflow/underflow issues and invalid address usage. Access control (7.3) is minimal, limited to standard ERC20 permissions, with no additional roles or privileged functions. The contract adheres to ERC20 standards and best practices for secure token implementation.

Governance1/10High risk

The economic model (7.4) is a simple fixed-supply token after initial minting, with no complex mechanisms, fees, or staking. Governance (7.5) is not present within the contract itself, as it's a basic token. The initial distribution mints all tokens to a single owner, which is a common but centralized starting point. External interactions (7.6) are non-existent, reducing attack surface.

Upgrades6/10Medium risk

The contract (7.7) is not designed to be upgradeable, meaning its logic is immutable once deployed. This eliminates upgrade-related risks such as proxy misconfigurations or logic errors during upgrades, but also prevents future modifications or bug fixes without a full redeployment. Operations (7.8) are straightforward, with no complex off-chain dependencies.

Final RecommendationWhat to do about this score

Ensure the initial owner address receiving the total supply is secured, ideally by a multi-signature wallet, to mitigate centralization risks.

Given the lack of emergency controls, consider the implications for potential exploits or misuse and whether a pause or blacklist mechanism aligns with the project's risk tolerance and decentralization goals. If future flexibility or bug fixes are anticipated, consider an upgradeable token standard for future deployments.

Contract & Record

1 audit on record
TypeSimpleToken
NetworkBase
Token age3mo
Contract0x853a…f841
Deployer0x9e39…92d2
Badge for your website
Play security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202636Medium
  2. Aug 16, 202632Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
The Stonks ExchangeSTONKEX · Base36MediumBasehatBase36MediumOpalBase36Mediumaixbt by VirtualsAIXBT · Base36MediumAn Amazon BoxBOX · Base36MediumOpenGradientOPG · Base37Medium

Would You Like a More Detailed Audit of Play?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page