Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Quack AI Token Safe?

QBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 2 audits on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades5/10Checks passed2 of 5Findings1 High · 1 Info2
SummaryAI Copilot

The PeerToken contract is an ERC-20 token with burnable and permit functionalities, extending OpenZeppelin's standard implementations.

Read the full analysis
What raised the score
  • Ownership not renounced — Timelock 48h delay
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 97.5%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
Exact factors
  • Ownership NOT renounced — Timelock 48h delay (exit window)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70% (154.3% total → 152.1% effective; 150.7% in EOAs, 3.6% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 97.5% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • 1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026

How the supply is spread across holders could not be read — the indexer's holder list does not add up to the supply. Check the largest holders on a block explorer, which reads current balances.

Liquidity

as of audit · Sep 4$1.04M across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$993.9KShare of depth95.1%
Top-1 Unlocked Holder97.5%
Top-3 Unlocked100.0%
Unlocked LP held by
0xf949…02980x0141…ba140x15bf…f86c

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Info
High

Centralized Unlimited Minting Authority

The PeerToken contract grants an onlyMinter role the ability to mint an unlimited quantity of new tokens via the mint(address _account, uint256 _amount) function. While the owner (a Timelock) can change the minter address, the minter itself has unchecked power over the token supply. A compromise of the minter's private key or a malicious minter could lead to arbitrary token inflation, severely devaluing existing tokens and impacting the protocol's economic stability (7.4 Economic, 7.3 Access Control).H-01

Issue

The PeerToken contract grants an onlyMinter role the ability to mint an unlimited quantity of new tokens via the mint(address _account, uint256 _amount) function. While the owner (a Timelock) can change the minter address, the minter itself has unchecked power over the token supply. A compromise of the minter's private key or a malicious minter could lead to arbitrary token inflation, severely devaluing existing tokens and impacting the protocol's economic stability (7.4 Economic, 7.3 Access Control).

Fix

Implement a more robust control mechanism for the minter role. Consider: 1) Using a multi-signature wallet for the minter address. 2) Implementing a minting cap (e.g., a maximum total supply or a rate limit for minting). 3) Introducing a time-locked minting approval process requiring multiple parties. 4) If unlimited minting is intended, ensure the minter's operational security is paramount.

Status

Unresolved

Info

Non-Upgradeable Contract

The PeerToken contract is deployed directly and does not utilize a proxy pattern, meaning it is not upgradeable (7.7 Upgrades). This implies that its logic cannot be modified or updated after deployment. While this eliminates upgrade-related security risks, it also means that any future bug fixes, feature enhancements, or changes to the token's economic model would require deploying an entirely new contract and migrating users/liquidity.I-01

Issue

The PeerToken contract is deployed directly and does not utilize a proxy pattern, meaning it is not upgradeable (7.7 Upgrades). This implies that its logic cannot be modified or updated after deployment. While this eliminates upgrade-related security risks, it also means that any future bug fixes, feature enhancements, or changes to the token's economic model would require deploying an entirely new contract and migrating users/liquidity.

Fix

This is an architectural decision. If future flexibility is desired, consider implementing an upgradeable proxy pattern (e.g., UUPS or Transparent Proxy) for future contracts. If immutability is the goal, ensure the current design is thoroughly reviewed and future-proofed.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The PeerToken contract is an ERC-20 token with burnable and permit functionalities, extending OpenZeppelin's standard implementations. It introduces a dedicated 'minter' role, separate from the 'owner', to control token supply. The contract's primary security strength lies in its use of well-audited OpenZeppelin libraries and a Timelock for the owner role. However, the centralized and unlimited minting capability by the 'minter' poses a significant economic risk, as a compromise of this role could lead to arbitrary token inflation and devaluation.

Technical6/10Medium risk

The technical implementation of PeerToken is robust, leveraging battle-tested OpenZeppelin contracts for ERC-20, ERC-20Permit, ERC-20Burnable, and Ownable functionalities (7.2 Code Security). Custom logic for the minter role is minimal and correctly implements access control via onlyMinter and onlyOwner modifiers (7.3 Access Control). No common Solidity vulnerabilities such as reentrancy, integer overflows, or front-running opportunities were identified in the custom code (7.2 Code Security).

Governance1/10High risk

The contract implements a robust access control system with distinct owner and minter roles (7.3 Access Control). The owner is a Timelock with a 48-hour delay, which significantly enhances governance security by introducing a delay for critical actions like changing the minter or transferring ownership (7.5 Governance, 7.8 Operations). However, the minter role holds significant power, allowing for an unlimited supply of tokens, which presents a high economic risk if compromised, potentially leading to severe token devaluation (7.4 Economic).

Upgrades5/10Medium risk

The PeerToken contract is not designed as an upgradeable proxy (7.7 Upgrades). This eliminates upgrade-related risks such as proxy implementation mismatches or storage collisions. However, it also means that the contract's logic cannot be modified or updated after deployment, requiring a new deployment for any future changes or bug fixes.

Final RecommendationWhat to do about this score

It is crucial to implement stringent security measures for the minter address, given its ability to arbitrarily inflate the token supply.

Consider using a multi-signature wallet or a more sophisticated governance mechanism for the minter role to distribute control and reduce the single point of failure risk. Additionally, ensure the Timelock owner's private keys are secured with the highest possible standards.

Contract & Record

2 audits on record
TypePeerToken
NetworkBNB Chain
Token age11mo
Contract0xc07e…0589
Deployer0x1a28…7af4
Badge for your website
Quack AI Token security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202667High
  2. Jul 27, 202651Medium
  3. Jul 27, 202664Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

Is Quack AI Token a scam?

Based on automated analysis, Quack AI Token scores 64/100 (High Risk) on our risk scale. No honeypot was detected, but always verify independently before investing.

Is Quack AI Token safe to buy?

Our scanner flagged a risk score of 64/100. Ownership has not been renounced, which is a risk factor. DYOR before purchasing any token.

Has Quack AI Token been audited?

The contract has not been verified on-chain. Verification is not the same as a full security audit. Use Quantum Audit's free tool to run a deeper analysis of the contract code.

Related Audits

6 more on the recordAll audits
Holoworld AIHOLO · BNB Chain67HighPowerBNB Chain67HighCreoEngineCREO · BNB Chain67HighOpenGradientOPG · BNB Chain67HighpumpBTC Governance tokenPUMP · BNB Chain67HighXPULSBNB Chain66High

Would You Like a More Detailed Audit of Quack AI Token?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page