Quantum Audit Logo

Is Sekuya Safe?

On-chain security analysis — is it a scam or legit?

Sekuya SKYA
0x623c…b6e9
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The SekuyaToken contract is an ERC20 token with burnable and access control features, built upon OpenZeppelin libraries. The primary risks identified are the centralized control over token minting and the single point of failure for administrative roles, which could lead to economic instability if compromised. The contract is not upgradeable, limiting future flexibility.

1 High1 Medium2 Informational
Volume 24h
$4.9K
Liquidity
$19.3K
Price
$0.000377
Token Age
2y
Top 10 Holders
46.6%

Security Findings

1 High1 Med2 Info
High

Centralized Minting Authority

H-01The `MINTER_ROLE` has the authority to mint new tokens up to the `MAX_SUPPLY` (1 billion tokens). This centralized control over the token supply introduces a significant economic risk, as the token supply can be increased by a single entity, potentially leading to dilution for existing token holders if not managed transparently and responsibly. This power is granted to the deployer in the constructor.
IssueThe `MINTER_ROLE` has the authority to mint new tokens up to the `MAX_SUPPLY` (1 billion tokens). This centralized control over the token supply introduces a significant economic risk, as the token supply can be increased by a single entity, potentially leading to dilution for existing token holders if not managed transparently and responsibly. This power is granted to the deployer in the constructor.
FixImplement a multi-signature wallet for the `MINTER_ROLE` to ensure that minting operations require consensus from multiple trusted parties. Clearly communicate the minting policy and schedule to the community. Consider mechanisms to decentralize or restrict minting power further in the future if appropriate for the project's roadmap.
StatusUnresolved
Medium

Single Point of Failure for Administrative Roles

M-01The contract's constructor grants both the `DEFAULT_ADMIN_ROLE` and `MINTER_ROLE` to the deployer's address (`_msgSender()`). This design creates a single point of failure for all administrative functions and token minting. If the private key associated with this single address is compromised, an attacker could gain full control over role management (granting/revoking any role) and the ability to mint tokens up to the maximum supply.
IssueThe contract's constructor grants both the `DEFAULT_ADMIN_ROLE` and `MINTER_ROLE` to the deployer's address (`_msgSender()`). This design creates a single point of failure for all administrative functions and token minting. If the private key associated with this single address is compromised, an attacker could gain full control over role management (granting/revoking any role) and the ability to mint tokens up to the maximum supply.
FixTransfer the `DEFAULT_ADMIN_ROLE` to a robust multi-signature wallet immediately after deployment. This will distribute control and require multiple approvals for critical administrative actions, significantly reducing the risk associated with a single compromised key.
StatusUnresolved
Info

Non-Upgradeable Contract

I-01The `SekuyaToken` contract is deployed as a standard implementation contract and does not utilize any proxy patterns (e.g., UUPS, Transparent). This means that the contract's logic is immutable after deployment. Any future bug fixes, feature enhancements, or changes to the token's economic model would necessitate deploying an entirely new contract and migrating existing token holders, which can be a complex and costly process.
IssueThe `SekuyaToken` contract is deployed as a standard implementation contract and does not utilize any proxy patterns (e.g., UUPS, Transparent). This means that the contract's logic is immutable after deployment. Any future bug fixes, feature enhancements, or changes to the token's economic model would necessitate deploying an entirely new contract and migrating existing token holders, which can be a complex and costly process.
FixWhile not a vulnerability, it's important for the project team to be aware of this limitation. For future projects or if flexibility is a high priority, consider implementing an upgradeable proxy pattern (e.g., UUPS) to allow for future contract modifications without requiring a full redeployment and migration.
StatusUnresolved
Info

Hardcoded Maximum Supply

I-02The `MAX_SUPPLY` for the token is defined as a `public constant` within the contract. While this provides clarity and prevents accidental changes, it means the maximum possible token supply cannot be adjusted after deployment without deploying a new contract. This rigidity might limit future economic model adjustments if the project's needs evolve.
IssueThe `MAX_SUPPLY` for the token is defined as a `public constant` within the contract. While this provides clarity and prevents accidental changes, it means the maximum possible token supply cannot be adjusted after deployment without deploying a new contract. This rigidity might limit future economic model adjustments if the project's needs evolve.
FixEnsure that the `MAX_SUPPLY` value is thoroughly reviewed and aligns with the long-term vision for the token's economics. If future flexibility for supply adjustments is desired, consider making the `MAX_SUPPLY` a state variable that can be modified by a privileged role (e.g., `DEFAULT_ADMIN_ROLE`) under strict governance, though this introduces its own set of risks.
StatusUnresolved

Category Ratings

TechnicalLow7/10

The contract demonstrates strong technical quality (7.2 Code Security) by leveraging battle-tested OpenZeppelin libraries for ERC20, ERC20Burnable, and AccessControl functionalities. This significantly reduces the likelihood of common vulnerabilities like reentrancy or integer overflows, as these libraries are extensively audited. The implementation of `unchecked` blocks in `_transfer`, `_mint`, `_burn`, and `decreaseAllowance` is correctly guarded by prior `require` statements, ensuring arithmetic safety. The overall architecture (7.1 Architecture) is simple and follows standard token patterns.

GovernanceHigh3/10

The economic model (7.4 Economic) of SekuyaToken relies heavily on a centralized `MINTER_ROLE`, which can mint tokens up to a `MAX_SUPPLY`. This introduces a significant risk of token dilution if the role is misused or compromised. Furthermore, the contract's governance (7.5 Governance) is entirely centralized through the `DEFAULT_ADMIN_ROLE`, which can grant or revoke any other role, including the minter role. This creates a single point of failure (7.3 Access Control) where a compromise of the initial deployer's address could lead to full control over the token supply and administrative functions.

UpgradesMedium4/10

The SekuyaToken contract is deployed as a standard implementation contract and does not utilize any proxy patterns (7.7 Upgrades). This means the contract's logic is immutable after deployment. While this eliminates risks associated with upgrade mechanisms, it also means that any future bug fixes, feature enhancements, or changes to the token's economic model would require deploying an entirely new contract and migrating existing token holders, which can be a complex and costly process.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedPass
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

46.6% in top 10
28.8% in wallets17.8% in contracts
Effective Concentration35.9%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$19.3K across 4 pairs
Uniswap v2WETHanalysed$19.3K99.9%Uniswap v3WETH$230.1%Uniswap v4ETH$10.0%Alien-baseWETH$00.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Locked52.0% · Null Address, UNCX
Top-1 Unlocked Holder28.2%
Top-3 Unlocked47.9%

Key Addresses

8 addresses
Deployer
0x7a15…5a53
Unlocked LP Held By
0x8ff5…196f0x264d…3e470xd76a…8baa0xb3b6…73330x8a7f…976f0xead0…2d120x65bb…642a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (46.6% total → 35.9% effective; 28.8% in EOAs, 17.8% in contracts — moderate)
  • Liquidity < $50k ($19,318 across 4 pairs — thin market)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
EURCHigh RiskCoinbase Wrapped BTC (CBBTC)High RiskDotHigh RiskRibbita by Virtuals (TIBBIR)High RiskPromptHigh RiskCoinbase Wrapped XRP (CBXRP)High Risk

Would You Like a More Detailed Audit of Sekuya?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit