On-chain security analysis — is it a scam or legit?
EthereumThe protocol implements a centralized stablecoin with robust administrative controls, including minting, burning (clawback), and account-level pausing.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 21, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x0a40…97590xdfc7…ace7No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint capability, holder concentration) were applied separately and feed the risk score.
Re-check after any contract upgrade or ownership change, both of which can alter behaviour without changing this page.
Acknowledged
The ten largest holders own 68.4% of supply. What remains: 40.8% in wallets, 27.6% in other contracts. 12,847 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Ripple USD (RLUSD), market cap $2.4B, rank #43. 12,847 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $103.1M (DexScreener, all pools). 24h trading volume $167.7M (CoinGecko, all markets, daily snapshot). 24h trading volume $27.2M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The contract lets its controller — an owner that could not be resolved — mint new supply; pause all transfers. These are the issuer's controls by design; for a verified issuer they are counterparty risk — the issuer can act on any holder, including you.
Check who holds these powers and whether a timelock or multisig stands between them and holders.
Acknowledged
A token designed to hold a fixed value (usually $1). Its safety rests on what backs it and on who can mint, freeze or pause it. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Fiat-backed Stablecoin. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $103.1M of DEX liquidity across 10 pools. Launch: 671 days of market history.
Check what backs the peg and who controls supply: reserve attestations for an issuer-backed coin, collateral and governance for a protocol coin.
Acknowledged
The protocol implements a centralized stablecoin with robust administrative controls, including minting, burning (clawback), and account-level pausing. The architecture utilizes a UUPS proxy pattern for upgradability. No critical or high-severity vulnerabilities were identified during the static analysis of the provided contract logic.
The architecture follows standard OpenZeppelin patterns for ERC-20 and AccessControl, ensuring 7.1 Architecture and 7.2 Code Security standards are met. 7.3 Access Control is strictly enforced via role-based modifiers on all sensitive functions like mint and clawback. 7.6 External dependencies are limited to well-audited library contracts, minimizing the attack surface.
7.4 Economic and 7.5 Governance risks are inherent to the centralized nature of the token. The ability for privileged roles to mint and clawback tokens represents a significant trust requirement for token holders. Operations (7.8) are centralized, meaning the security of the protocol relies entirely on the protection of the private keys associated with the administrative roles.
The protocol utilizes the UUPS proxy pattern (7.7 Upgrades), which is the current industry standard for gas-efficient and secure upgrades. The implementation contract is correctly linked to the proxy, and access to the upgrade function is restricted to authorized roles. This ensures that future logic changes can be managed securely without disrupting the existing state.
The protocol is well-structured and follows secure development patterns.
It is recommended to implement a multi-signature wallet or a timelock controller for all administrative roles to mitigate the risk of a single compromised key performing unauthorized minting or clawback actions. Ensure that the private keys for the MINTER_ROLE, CLAWBACKER_ROLE, and PAUSER_ROLE are stored in a secure, offline environment (e.g., hardware security modules) to maintain the integrity of the token supply and user account status.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The RLUSD contract on Ethereum is 0x8292bb45bf1ee4d140127049757c2e0ff06317ed. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for RLUSD is 11/100 (Low risk) as of Oct 21, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 21, 2026). Total DEX liquidity: $103.12M.
As of Oct 21, 2026, the 10 largest holders own 68.4% of the supply across 12,847 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
