Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Rayls Safe?

RLSEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 26, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades5/10Checks passed5 of 7Findings1 Critical · 1 Medium · 4 Info6
SummaryAI Copilot

The RaylsToken contract is an upgradeable ERC-20 token utilizing the UUPS pattern.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Liquidity not locked
  • Liquidity < $50k
  • Top-10 concentration > 30%
  • Code: Unprotected Implementation Contract Initialization
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Liquidity NOT locked (100% of the pool; this pool is 80% of DEX liquidity) — held by independent providers — market-depth risk
  • Liquidity < $50k ($17,743 across 3 pairs — thin market)
  • Top-10 concentration > 30% (63.8% total → 36.7% effective; 18.7% in EOAs, 45.1% in contracts)
  • Code: Unprotected Implementation Contract Initialization (Critical, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 265 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 26, 202646,483 holders
45.1%Contracts18.7%Wallets36.2%Everyone else
45.1%Contracts18.7%Wallets36.2%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
63.8%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking45.1%
  • Walletsanonymous holders, free to sell18.7%
  • Everyone else46,473 holders36.2%
Effective concentrationwhat the score reads36.7%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 26, 2026

Liquidity

as of audit · Oct 26$17.7K across 3 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$14.1KShare of depth79.7%
Top-1 Unlocked Holder34.3%
Top-3 Unlocked86.2%
Unlocked LP held by
0x39a1…cae60x3b0c…3fcd0xf949…02980xe731…2356

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 Medium4 Info
Critical

Unprotected Implementation Contract Initialization

The implementation contract is not initialized upon deployment, allowing any user to call the initialize function. This could allow an attacker to take control of the implementation logic or potentially disrupt the proxy's upgradeability.CD-01

Issue

The implementation contract is not initialized upon deployment, allowing any user to call the initialize function. This could allow an attacker to take control of the implementation logic or potentially disrupt the proxy's upgradeability.

Fix

Add a constructor to the implementation contract that calls _disableInitializers() to ensure the implementation cannot be initialized after deployment.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 4 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 80% of the token's DEX liquidity; the other pools were not assessed.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 4 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 80% of the token's DEX liquidity; the other pools were not assessed.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

Who holds the supply

The ten largest holders own 63.8% of supply. What remains: 18.7% in wallets, 45.1% in other contracts. 46,483 holders in total.QA-HOLDERS

Issue

The ten largest holders own 63.8% of supply. What remains: 18.7% in wallets, 45.1% in other contracts. 46,483 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Identity verified by independent sources

Listed on CoinGecko as Rayls (RLS), market cap $5M, rank #1587. Traded on Coinbase. 46,483 holders. Verified by: exchange listings.QA-IDENTITY

Issue

Listed on CoinGecko as Rayls (RLS), market cap $5M, rank #1587. Traded on Coinbase. 46,483 holders. Verified by: exchange listings.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $18K (DexScreener, all pools). 24h trading volume $7.1M (CoinGecko, all markets, daily snapshot). 24h trading volume $43K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.0364 on 2025-12-02; the price is now 92.5899% below it.QA-MARKET

Issue

Liquidity $18K (DexScreener, all pools). 24h trading volume $7.1M (CoinGecko, all markets, daily snapshot). 24h trading volume $43K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.0364 on 2025-12-02; the price is now 92.5899% below it.

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $18K of DEX liquidity across 3 pools. Launch: 179 days of market history.QA-PROFILE

Issue

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: fixed — the contract has no mint function. Control: an owner that could not be resolved. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $18K of DEX liquidity across 3 pools. Launch: 179 days of market history.

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 26
Executive SummaryWhat the contract is and what the review found

The RaylsToken contract is an upgradeable ERC-20 token utilizing the UUPS pattern. While it implements standard OpenZeppelin libraries for access control and pausing, a critical vulnerability exists in the initialization of the implementation contract, which could allow an attacker to take control of the proxy logic. The protocol relies on centralized roles for minting and pausing, which are standard but require secure key management.

Technical6/10Medium risk

The architecture follows standard UUPS proxy patterns, ensuring modularity and upgradeability. 7.1 Architecture is sound, utilizing established OpenZeppelin standards for 7.2 Code Security. However, 7.3 Access Control is undermined by the failure to secure the implementation contract, allowing unauthorized initialization. 7.6 External dependencies are well-managed via standard library imports.

Governance1/10High risk

7.4 Economic parameters are defined by a single minting event, preventing inflation after the initial supply is created. 7.5 Governance is centralized via AccessControl roles, which is appropriate for a controlled token but creates a single point of failure. The minting process is strictly gated by a MINTER_ROLE, ensuring supply integrity once the initial state is set.

Upgrades5/10Medium risk

7.7 Upgrades are handled via UUPS, which is gas-efficient and secure when implemented correctly. 7.8 Operations are supported by pause/unpause functionality to mitigate emergency risks. The current implementation lacks a constructor-based initialization lock, creating a critical risk during the deployment lifecycle.

Final RecommendationWhat to do about this score

Immediately initialize the implementation contract upon deployment or add a constructor that calls _disableInitializers() to prevent unauthorized initialization.

Ensure that all privileged roles (MINTER_ROLE, PAUSER_ROLE) are assigned to multi-signature wallets or time-locked governance contracts to prevent single-point-of-failure risks.

Contract & Record

1 audit on record
TypeRaylsToken
NetworkEthereum
Token age5mo
Contract0xb5f7…4fbd
Deployer0x29cc…1d12
Badge for your website
Rayls security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Oct 26, 202672High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the RLS contract address?

The Rayls (RLS) contract on Ethereum is 0xb5f7b021a78f470d31d762c1dda05ea549904fbd. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Rayls a scam?

Quantum Audit's risk score for Rayls is 72/100 (High risk) as of Oct 26, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is RLS liquidity locked?

Liquidity lock: Not locked (as of Oct 26, 2026). Total DEX liquidity: $17.7K.

Who holds RLS?

As of Oct 26, 2026, the 10 largest holders own 63.8% of the supply across 46,483 holders. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
PayPal USDPYUSD · Ethereum72HighAgoras TokenAGRS · Ethereum72HighXRAYEthereum72HighNEXOEthereum73HighCronosCRO · Ethereum73HighEpic ChainEPIC · Ethereum73High

Would You Like a More Detailed Audit of Rayls?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Add your links and get it Verified