On-chain security analysis — is it a scam or legit?
EthereumThe Rekt token is a standard ERC-20 token utilizing audited OpenZeppelin libraries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xf60e…669f0x6d8d…00120xa63b…fbee0x8cf6…9cdf0x9abc…9d9d0x81df…fdb60x47b6…b1a5No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
During contract deployment, a substantial amount of 420,690,000,000,000 tokens (420.69 quadrillion) was minted to a single address (). This concentration of nearly the entire token supply in one address creates a single point of control, enabling potential market manipulation, rug pulls, or significant influence over any DeFi protocols integrating this token. This poses a severe economic risk to other token holders and the overall ecosystem.
For future token deployments, consider implementing a more decentralized initial distribution strategy. This could involve vesting schedules, fair launch mechanisms, or distributing tokens across multiple addresses controlled by different entities to mitigate the risk associated with a single point of failure and control.
Unresolved
ERC20Pausable and includes pause() and unpause() functions, which are restricted to the onlyOwner modifier. However, the provided prefill indicates that ownership has been renounced. While renouncing ownership removes the centralization risk of an owner arbitrarily pausing transfers, it also renders the token permanently unpausable. This means that in the event of a critical vulnerability in an integrated DeFi protocol or a severe market exploit, there is no mechanism to halt token transfers to prevent further damage.M-01The contract inherits ERC20Pausable and includes pause() and unpause() functions, which are restricted to the onlyOwner modifier. However, the provided prefill indicates that ownership has been renounced. While renouncing ownership removes the centralization risk of an owner arbitrarily pausing transfers, it also renders the token permanently unpausable. This means that in the event of a critical vulnerability in an integrated DeFi protocol or a severe market exploit, there is no mechanism to halt token transfers to prevent further damage.
Acknowledge the trade-off between decentralization (no owner to pause) and emergency response capability (no ability to pause). If an emergency pause mechanism is deemed necessary for future versions or similar projects, consider alternative decentralized governance-controlled pause mechanisms (e.g., multi-sig or DAO-controlled) rather than relying solely on Ownable.
Unresolved
The Rekt token contract is deployed without any upgradeability pattern (e.g., proxy contracts). This design choice makes the contract's logic immutable once deployed. While immutability provides certainty and reduces upgrade-related risks, it also means that any bugs discovered post-deployment cannot be fixed, and new features or protocol adjustments cannot be implemented without deploying an entirely new token contract.
Ensure that the current contract logic is thoroughly tested and deemed final, as no changes can be made. For projects requiring flexibility or long-term maintenance, consider implementing an upgradeable contract pattern in future iterations, along with robust upgrade safety procedures.
Unresolved
The Rekt token contract extensively utilizes well-regarded and audited OpenZeppelin contracts (ERC20, Ownable, ERC20Burnable, ERC20Pausable, ERC20Permit). This significantly enhances the baseline security of the contract by leveraging battle-tested code. However, the security of the Rekt token is inherently dependent on the continued security and correct implementation of these external libraries.
Continue to monitor OpenZeppelin's security advisories and updates. While OpenZeppelin contracts are highly secure, any newly discovered vulnerabilities in their libraries could potentially affect dependent contracts. Ensure that the specific versions used are up-to-date and free from known issues.
Unresolved
The Rekt token is a standard ERC-20 token utilizing audited OpenZeppelin libraries. It features burnable, pausable, and permit functionalities. A significant portion of the token supply was minted to a single address during deployment, leading to high centralization. The contract is not upgradeable, and ownership has been renounced, making the token unpausable.
The Rekt token contract (7.1 Architecture, 7.2 Code Security) is built upon well-audited OpenZeppelin ERC20, Ownable, Burnable, Pausable, and Permit libraries, significantly reducing the likelihood of common coding vulnerabilities like reentrancy or integer overflows. The custom logic is minimal, primarily consisting of a constructor for initial minting and simple pause/unpause functions. The _update override correctly integrates the pausable functionality. No complex or novel attack vectors were identified within the custom code.
The economic model (7.4 Economic) presents a high centralization risk due to the initial minting of 420,690,000,000,000 tokens (420.69 quadrillion) to a single address () during deployment. This address holds virtually the entire token supply, granting it immense control over market dynamics and potential for price manipulation. While the Ownable contract (7.3 Access Control) initially provided the deployer with control over pausing transfers, the prefill indicates ownership has been renounced (7.5 Governance), which removes this centralized control but introduces immutability regarding pausing.
The Rekt token contract is not designed with upgradeability features (7.7 Upgrades). This means its logic is immutable post-deployment, preventing any future modifications or bug fixes. While this eliminates upgrade-related risks, it also removes the flexibility to adapt to new requirements or address unforeseen issues.
Given the high centralization of token supply, it is crucial to transparently communicate the distribution strategy and the role of the address holding the majority of tokens.
For long-term project health, consider a more decentralized distribution mechanism if future iterations are planned. The renouncement of ownership makes the token unpausable; ensure this is an intentional design choice, as it removes an emergency stop mechanism.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Rekt contract on Ethereum is 0xdd3b11ef34cd511a2da159034a05fcb94d806686. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Rekt is 13/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $1.32M.
As of Sep 4, 2026, the 10 largest holders own 45.5% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
