Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is PRDCTR Safe?

PRDEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades1/10Checks passed2 of 5Findings1 Low · 2 Info3
SummaryAI Copilot

The audit of the ConfigurableTokenUpgradeable contract, deployed via an ERC1967Proxy, reveals a well-structured and minimal ERC-20 token implementation.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Proxy contract
  • Top-10 concentration > 30%
  • Liquidity not locked
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-4)
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 30% (95.8% total → 39.0% effective; 1.1% in EOAs, 94.7% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • LP top1 unlocked holder = 100.0% (exit-liquidity risk)
  • LP top3 unlocked holders = 100.0% (exit-liquidity risk)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
94.7%Contracts4.2%
94.7%Contracts4.2%
ContractsWalletsEveryone elseBubble area = share of supply
95.8%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking94.7%
  • Walletsanonymous holders, free to sell1.1%
  • Everyone elsethe rest of the supply4.2%
Effective concentrationwhat the score reads39.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$6.32M across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$6.32MShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x528e…a5c20x9da9…b37b0x7e5c…6c50

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

Security Findings

1 Low2 Info
Low

Centralized Control by Owner

The ConfigurableTokenUpgradeable contract grants significant control to the contract owner, including the ability to authorize contract upgrades (_authorizeUpgrade), transfer ownership, and renounce ownership. The initial token configuration (name, symbol, decimals, initial supply, initial holder) is also set by the owner during initialization. The prefill indicates the owner is a 2/4 multisig.L-01

Issue

The ConfigurableTokenUpgradeable contract grants significant control to the contract owner, including the ability to authorize contract upgrades (_authorizeUpgrade), transfer ownership, and renounce ownership. The initial token configuration (name, symbol, decimals, initial supply, initial holder) is also set by the owner during initialization. The prefill indicates the owner is a 2/4 multisig.

Fix

While the use of a multisig wallet for ownership significantly mitigates the risk of a single point of failure, it is crucial that the multisig signers are trustworthy, follow robust operational security practices, and that the multisig threshold is appropriate for the protocol's risk profile. Consider implementing time-locks for critical operations like upgrades if further decentralization or safety is desired.

Status

Unresolved

Info

Custom Decimals Implementation

The ConfigurableTokenUpgradeable contract overrides the decimals() function from ERC20Upgradeable to return a custom _decimals value set during initialization, rather than the default 18. While this provides flexibility, it deviates from the common ERC-20 standard of 18 decimals.I-01

Issue

The ConfigurableTokenUpgradeable contract overrides the decimals() function from ERC20Upgradeable to return a custom _decimals value set during initialization, rather than the default 18. While this provides flexibility, it deviates from the common ERC-20 standard of 18 decimals.

Fix

Ensure all integrations and user interfaces are aware of and correctly handle the token's configurable decimal count to prevent display issues or misinterpretations. Clearly document this design choice in external documentation.

Status

Unresolved

Info

Reinitializer for ERC20Permit

The initializePermit() function is marked as a reinitializer(2), allowing it to be called multiple times if the reinitialization flag for slot 2 is reset. This function re-initializes the ERC20Permit component by calling __ERC20Permit_init(name()).I-02

Issue

The initializePermit() function is marked as a reinitializer(2), allowing it to be called multiple times if the reinitialization flag for slot 2 is reset. This function re-initializes the ERC20Permit component by calling __ERC20Permit_init(name()).

Fix

Confirm the specific use case and necessity for ERC20Permit re-initialization. While generally safe, ensure that repeated calls do not introduce unexpected state changes or gas inefficiencies if not genuinely required.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The audit of the ConfigurableTokenUpgradeable contract, deployed via an ERC1967Proxy, reveals a well-structured and minimal ERC-20 token implementation. The contract leverages battle-tested OpenZeppelin upgradeable libraries for ERC-20, ERC-20 Permit, Ownable, and UUPS functionality. No critical or high-severity vulnerabilities were identified. Minor observations include the custom decimals implementation and the reinitializer for ERC20Permit. Centralized control by the owner (a multisig) for upgrades and initial configuration is noted, which is typical for such tokens.

Technical8/10Low risk

The technical architecture (7.1) is robust, utilizing OpenZeppelin's upgradeable contracts for ERC-20, ERC-20 Permit, Ownable, and UUPS proxy patterns. Code security (7.2) is high, benefiting from OpenZeppelin's audited codebase and Solidity 0.8+ default overflow/underflow checks. The contract correctly implements unstructured storage for upgradeability, preventing storage collisions. A notable design choice is the custom decimals() override, allowing for flexible token configurations.

Governance1/10High risk

The economic model (7.4) is that of a standard ERC-20 token with an initial supply minted to a specified holder. Governance (7.5) is centralized, with the contract owner having control over initial token parameters and upgrades. The prefill indicates the owner is a 2/4 multisig, which enhances security by requiring multiple approvals for critical actions, mitigating single-point-of-failure risks. However, the owner retains significant power over the token's future.

Upgrades1/10High risk

The contract implements the UUPS upgrade pattern (7.7), with the _authorizeUpgrade function correctly restricted to the onlyOwner modifier. This ensures that only the designated owner can initiate contract upgrades. The use of OpenZeppelin's upgradeable contracts with explicit storage structs and gaps minimizes the risk of storage collisions during upgrades, contributing to a secure upgrade path. The primary risk remains the owner's ability to upgrade to potentially malicious code.

Final RecommendationWhat to do about this score

It is recommended to maintain robust operational security practices for the multisig wallet controlling the contract owner address, given its extensive control over upgrades and token configuration.

Regular reviews of multisig signers and their security postures are crucial. For enhanced decentralization and safety, consider implementing a time-lock mechanism for critical owner-controlled operations, especially contract upgrades, to provide a window for community review and reaction.

Contract & Record

1 audit on record
TypeERC1967Proxy
NetworkEthereum
Token age1mo
Contract0xc847…efe5
Deployer0x528e…a5c2
Proxy Upgrade Controls
Proxy TypeEip1967 Uups
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
PRDCTR security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202664Medium
  2. Aug 17, 202647Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the PRD contract address?

The PRDCTR (PRD) contract on Ethereum is 0xc84782858b7bef5d25182dbac956a6aa463aefe5. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is PRDCTR a scam?

Quantum Audit's risk score for PRDCTR is 64/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is PRD liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $6.32M.

Who holds PRD?

As of Sep 4, 2026, the 10 largest holders own 95.8% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
EspressoESP · Ethereum64MediumAXGTEthereum64MediumNumeraireNMR · Ethereum64MediumVertical AIVERTAI · Ethereum64MediumWrapped REACTREACT · Ethereum64MediumSPACE IDID · Ethereum63Medium

Would You Like a More Detailed Audit of PRDCTR?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page