Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Relics Safe?

RELICSEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance4/10Upgrades8/10Checks passed4 of 5Findings1 Critical · 1 High · 1 Medium · 1 Info4
SummaryAI Copilot

The RelicsToken contract implements an ERC20 token with custom logic for tracking 'active holders' and interacting with an NFT system.

Read the full analysis
What raised the score
  • Top-10 concentration > 20%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • Token age < 30 days
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
Exact factors
  • Top-10 concentration > 20% (42.9% total → 24.3% effective; 12.0% in EOAs, 30.9% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k ($30,116 across 1 pairs — thin market)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • Token age < 30 days (still settling)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 44 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
30.9%Contracts12.0%Wallets57.1%Everyone else
30.9%Contracts12.0%57.1%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
42.9%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking30.9%
  • Walletsanonymous holders, free to sell12.0%
  • Everyone elsethe rest of the supply57.1%
Effective concentrationwhat the score reads24.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$30.1K

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$30.1KShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x147a…03f8

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 High1 Medium1 Info
Critical

Critical Unconfigurable Parameters Due to Renounced Ownership

The relicsNFT, relicSyncPool, and relicLocker addresses are critical for the contract's functionality, enabling interactions with the NFT system and defining special accounts. These addresses are set via onlyOwner functions (setRelicsNFT, setRelicSyncPool, setRelicLocker). The prefill data indicates that ownership of the contract is renounced. If these parameters are not configured during the initial deployment transaction or immediately thereafter (before ownership renunciation), they can never be set, rendering core functionalities like transferRelicToken, _update's syncBalances call, and _syncHolder exclusions permanently non-functional or severely limited. This rep…C-01

Issue

The relicsNFT, relicSyncPool, and relicLocker addresses are critical for the contract's functionality, enabling interactions with the NFT system and defining special accounts. These addresses are set via onlyOwner functions (setRelicsNFT, setRelicSyncPool, setRelicLocker). The prefill data indicates that ownership of the contract is renounced. If these parameters are not configured during the initial deployment transaction or immediately thereafter (before ownership renunciation), they can never be set, rendering core functionalities like transferRelicToken, _update's syncBalances call, and _syncHolder exclusions permanently non-functional or severely limited. This rep…

Fix

Ensure that all critical configuration parameters (relicsNFT, relicSyncPool, relicLocker) are set either within the constructor or through onlyOwner functions immediately after deployment, and *before* ownership is renounced. A multi-signature wallet or a time-locked governance mechanism could be used to manage these settings if ownership is not renounced, but given the renounced status, initial setup is paramount. Consider a deployment script that atomically sets these values.

Status

Unresolved

High

Reentrancy Risk in _update via External Call to IRelicsNFT.syncBalances

The _update function, which is called during every ERC20 transfer (e.g., transfer, transferFrom), makes an external call to IRelicsNFT(nft).syncBalances(from, to). While the _relicTransferInProgress flag is used to prevent reentrancy specifically during transferRelicToken calls, it does not protect against re-entrant calls initiated by standard ERC20 transfers. If the relicsNFT contract is malicious or compromised, it could re-enter RelicsToken (e.g., by calling transfer again) before the _update function completes, leading to unexpected state changes or token manipulation (7.2 Code Security).H-01

Issue

The _update function, which is called during every ERC20 transfer (e.g., transfer, transferFrom), makes an external call to IRelicsNFT(nft).syncBalances(from, to). While the _relicTransferInProgress flag is used to prevent reentrancy specifically during transferRelicToken calls, it does not protect against re-entrant calls initiated by standard ERC20 transfers. If the relicsNFT contract is malicious or compromised, it could re-enter RelicsToken (e.g., by calling transfer again) before the _update function completes, leading to unexpected state changes or token manipulation (7.2 Code Security).

Fix

Implement a reentrancy guard (e.g., OpenZeppelin's ReentrancyGuard or a simple mutex) around the _update function, or specifically around the external call to IRelicsNFT(nft).syncBalances. This would prevent re-entrant calls from external contracts during any token transfer operation.

Status

Unresolved

Medium

Low Fixed Supply and Potential for Price Volatility

The RelicsToken has a FIXED_SUPPLY of 10,000 tokens (10,000 ether). This is a relatively small total supply for an ERC20 token. While not a direct code vulnerability, a low supply can contribute to higher price volatility and potentially make the token more susceptible to market manipulation, especially if liquidity is also low. The economic impact depends heavily on the token's intended utility and role within the broader Relics ecosystem (7.4 Economic).M-01

Issue

The RelicsToken has a FIXED_SUPPLY of 10,000 tokens (10,000 ether). This is a relatively small total supply for an ERC20 token. While not a direct code vulnerability, a low supply can contribute to higher price volatility and potentially make the token more susceptible to market manipulation, especially if liquidity is also low. The economic impact depends heavily on the token's intended utility and role within the broader Relics ecosystem (7.4 Economic).

Fix

While changing the fixed supply is not possible post-deployment, it is important to acknowledge and manage the implications of a low supply. Implement robust liquidity provisions and consider mechanisms to mitigate extreme price fluctuations if the token is intended for broad market use. Clearly communicate the economic model and potential volatility to users.

Status

Unresolved

Info

Dependency on External IRelicsNFT Contract

The RelicsToken contract has a significant dependency on the IRelicsNFT interface and its implementation. Functions like _update call IRelicsNFT(nft).syncBalances(from, to), and _requireHoldsNoRelics calls IRelicsNFT(nft).balanceOf(account). The security and correct functioning of RelicsToken are directly tied to the security, behavior, and availability of the IRelicsNFT contract. Any vulnerabilities, unexpected behavior, or upgrade issues in IRelicsNFT could directly impact RelicsToken (7.6 External).I-01

Issue

The RelicsToken contract has a significant dependency on the IRelicsNFT interface and its implementation. Functions like _update call IRelicsNFT(nft).syncBalances(from, to), and _requireHoldsNoRelics calls IRelicsNFT(nft).balanceOf(account). The security and correct functioning of RelicsToken are directly tied to the security, behavior, and availability of the IRelicsNFT contract. Any vulnerabilities, unexpected behavior, or upgrade issues in IRelicsNFT could directly impact RelicsToken (7.6 External).

Fix

Ensure that the IRelicsNFT contract is thoroughly audited, well-maintained, and deployed at a trusted address. Implement robust monitoring for the IRelicsNFT contract to detect any anomalies or compromises that could affect RelicsToken.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The RelicsToken contract implements an ERC20 token with custom logic for tracking 'active holders' and interacting with an NFT system. The audit identified a critical operational flaw related to the contract's configurability given its renounced ownership status, alongside a high-severity reentrancy risk. Several informational points regarding economic design and external dependencies were also noted. The prefill indicates ownership is renounced, which significantly impacts the contract's operational flexibility.

Technical7/10Low risk

The contract demonstrates good adherence to ERC20 standards and uses OpenZeppelin's Ownable for access control (7.3). Custom error messages enhance clarity, and unchecked blocks for counters are used appropriately (7.2 Code Security). However, a significant reentrancy risk exists in the _update function due to an external call to IRelicsNFT.syncBalances without a reentrancy guard for standard ERC20 transfers (7.2 Code Security). The architecture (7.1) relies on external contracts, introducing dependency risks (7.6 External).

Governance4/10Medium risk

The economic design includes a fixed, relatively low supply of 10,000 tokens (7.4 Economic), which could lead to high volatility. The HOLDER_THRESHOLD mechanism for 'active holders' is a core economic feature, but its full impact depends on the broader ecosystem. The most significant governance and operational risk (7.8 Operations) stems from the renounced ownership combined with critical unconfigurable parameters, which could render key functionalities unusable if not set during deployment.

Upgrades8/10Low risk

The RelicsToken contract is not designed as an upgradeable proxy (7.7 Upgrades). It is a standard implementation contract, meaning its logic cannot be modified after deployment. This eliminates upgrade-specific risks but also means any discovered issues require a new deployment and migration.

Final RecommendationWhat to do about this score

It is crucial to ensure all critical configuration parameters (relicsNFT, relicSyncPool, relicLocker) are correctly set during the contract's deployment or immediately after, prior to ownership renunciation.

Implement a robust reentrancy guard for the _update function to protect against re-entrant calls from external contracts during standard ERC20 transfers. Thoroughly review the economic implications of the fixed low token supply within the broader protocol context.

Contract & Record

1 audit on record
TypeRelicsToken
NetworkEthereum
Token age7d
Contract0x8f29…2da9
Deployer0x0bda…9893
Badge for your website
Relics security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202652Medium
  2. Aug 11, 202637Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
UniswapUNI · Ethereum52MediumBIOEthereum52MediumVirtuals ProtocolVIRTUAL · Ethereum51MediumDeriveDRV · Ethereum51MediumLido DAOLDO · Ethereum51MediumFOXEthereum53Medium

Would You Like a More Detailed Audit of Relics?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page