Quantum Audit Logo

Is REAL WORLD APPAREL Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

REAL WORLD APPAREL JACKET
0x57ae…ffff
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

This audit covers the OpenZeppelin `Address` library, a foundational utility contract. The library provides robust and secure wrappers for low-level address interactions, including ETH transfers and arbitrary function calls. No direct vulnerabilities were identified within the library itself, which is a testament to its mature and well-audited design. The primary security considerations for this library relate to how it is integrated and utilized by other contracts, particularly concerning reentrancy and the interpretation of `isContract` for security-critical logic.

3 Informational
Volume 24h
$1.7K
Liquidity
$136.0K
Price
$0.0007981
Token Age
10d
Top 10 Holders
14.2%

Security Findings

3 Info
Info

Misinterpretation of `isContract` for Security Checks

I-01The `isContract` function, while correctly implemented, has inherent limitations explicitly detailed in its NatSpec documentation. It returns `false` for contracts in construction, externally-owned accounts (EOAs), and addresses where contracts will be created or have been destroyed. Relying on `isContract` to prevent calls from contracts (e.g., to protect against flash loan attacks or enforce EOA-only access) is explicitly discouraged by OpenZeppelin, as it breaks composability and can be circumvented (7.2 Code Security).
IssueThe `isContract` function, while correctly implemented, has inherent limitations explicitly detailed in its NatSpec documentation. It returns `false` for contracts in construction, externally-owned accounts (EOAs), and addresses where contracts will be created or have been destroyed. Relying on `isContract` to prevent calls from contracts (e.g., to protect against flash loan attacks or enforce EOA-only access) is explicitly discouraged by OpenZeppelin, as it breaks composability and can be circumvented (7.2 Code Security).
FixDevelopers should avoid using `isContract` as a primary security mechanism to restrict access or prevent specific types of attacks. Instead, implement robust access control using `Ownable`, `AccessControl`, or role-based systems, and design protocols to be resilient to contract interactions rather than trying to block them. For reentrancy protection, use `ReentrancyGuard` or the checks-effects-interactions pattern.
StatusUnresolved
Info

Reentrancy Risk with External Calls

I-02The `sendValue` function and `functionCallWithValue` facilitate external calls that transfer Ether or execute arbitrary code on another contract. The library's documentation explicitly warns about the potential for reentrancy vulnerabilities when using `sendValue`. While the library itself does not introduce reentrancy, its usage in a calling contract without proper safeguards (e.g., `ReentrancyGuard` or the checks-effects-interactions pattern) can lead to critical reentrancy exploits (7.2 Code Security).
IssueThe `sendValue` function and `functionCallWithValue` facilitate external calls that transfer Ether or execute arbitrary code on another contract. The library's documentation explicitly warns about the potential for reentrancy vulnerabilities when using `sendValue`. While the library itself does not introduce reentrancy, its usage in a calling contract without proper safeguards (e.g., `ReentrancyGuard` or the checks-effects-interactions pattern) can lead to critical reentrancy exploits (7.2 Code Security).
FixAny contract utilizing `sendValue` or `functionCallWithValue` must implement robust reentrancy protection. This typically involves ensuring state changes occur before external calls (checks-effects-interactions pattern) or using a reentrancy guard mechanism like OpenZeppelin's `ReentrancyGuard` contract. Thoroughly review all functions that perform external calls for reentrancy vulnerabilities.
StatusUnresolved
Info

Implications of Low-Level Call Usage

I-03The `Address` library provides robust wrappers for low-level `call`, `staticcall`, and `delegatecall` functions. While these wrappers handle error propagation and basic checks, using low-level calls, even wrapped, introduces complexity and potential risks. Developers must fully understand the target contract's behavior, potential side effects, and gas implications of arbitrary calls. Misuse of `delegatecall` in particular can lead to severe vulnerabilities if the target contract is untrusted or malicious, as it executes code in the context of the calling contract (7.2 Code Security).
IssueThe `Address` library provides robust wrappers for low-level `call`, `staticcall`, and `delegatecall` functions. While these wrappers handle error propagation and basic checks, using low-level calls, even wrapped, introduces complexity and potential risks. Developers must fully understand the target contract's behavior, potential side effects, and gas implications of arbitrary calls. Misuse of `delegatecall` in particular can lead to severe vulnerabilities if the target contract is untrusted or malicious, as it executes code in the context of the calling contract (7.2 Code Security).
FixWhen using `functionCall`, `functionStaticCall`, or `functionDelegateCall`, ensure that the target address is trusted and that the `data` payload is correctly constructed and validated. Exercise extreme caution with `functionDelegateCall`, as it grants the called contract full control over the calling contract's state. Prefer higher-level Solidity function calls when possible, and only use low-level calls when absolutely necessary and with thorough security analysis.
StatusUnresolved

Category Ratings

TechnicalLow10/10

The `Address` library demonstrates high technical quality, adhering to established Solidity best practices and OpenZeppelin's rigorous standards (7.2 Code Security). It provides secure wrappers for low-level calls (`sendValue`, `functionCallWithValue`), explicitly mitigating common pitfalls like insufficient gas for `transfer` and handling call failures. The library includes clear warnings within its NatSpec documentation regarding reentrancy risks and the limitations of `isContract` (7.1 Architecture). All external calls are properly checked for success, and revert reasons are bubbled up or custom messages are used, enhancing robustness.

GovernanceLow7/10

As a standalone utility library, the `Address` contract does not implement any direct governance mechanisms or economic models (7.5 Governance, 7.4 Economic). Its functionality is purely technical, providing building blocks for other contracts. Therefore, governance and economic risk levels are not applicable to this specific contract.

UpgradesLow9/10

The `Address` contract is a library, which means it is not directly upgradeable in the same manner as a typical contract (7.7 Upgrades). Once deployed, its code is immutable. Any updates would require deploying a new version of the library and updating all consuming contracts to reference the new address, or for proxy contracts to be re-pointed to new implementations that use an updated library.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

14.2% in top 10
5.7% in wallets8.5% in contracts
Effective Concentration9.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$136.0K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder50.8%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0x3cc2…7505
Unlocked LP Held By
0x12a5…9eab0x8815…288b

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

4 factors
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 50.8% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • Token age < 30 days (still settling)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
富贵Low RiskpricelessLow RiskTCryptochicks (TCC)Low Risk币安人生Low RiskSKYAILow RiskBLow Risk

Would You Like a More Detailed Audit of REAL WORLD APPAREL?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit