Quantum Audit Logo

Is SPACE ID Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

SPACE ID ID
0x2dff…6406
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

This audit focused solely on the OpenZeppelin `AccessControl.sol` library contract, which is a dependency for the `SpaceIDToken` contract. No custom logic for `SpaceIDToken` was provided for review, thus a comprehensive security assessment of the entire protocol cannot be performed. The `AccessControl` library itself is well-tested and widely used.

1 Low3 Informational
Volume 24h
$8.0K
Liquidity
$597.1K
Price
$0.03204
Token Age
8mo
Top 10 Holders
88.7%

Security Findings

1 Low3 Info
Low

Lack of Time-Lock for Critical Operations

L-01The `AccessControl` contract itself does not inherently include time-lock mechanisms for sensitive operations like `grantRole` or `revokeRole`. Without a time-lock, critical changes can be executed immediately, leaving no window for community or governance intervention in case of a compromised key or malicious action (7.5 Governance, 7.8 Operations).
IssueThe `AccessControl` contract itself does not inherently include time-lock mechanisms for sensitive operations like `grantRole` or `revokeRole`. Without a time-lock, critical changes can be executed immediately, leaving no window for community or governance intervention in case of a compromised key or malicious action (7.5 Governance, 7.8 Operations).
FixFor critical roles, especially the `DEFAULT_ADMIN_ROLE`, consider implementing a separate time-lock contract that acts as an intermediary for executing sensitive `AccessControl` functions. This introduces a delay, allowing for review and potential cancellation of malicious or erroneous operations.
StatusUnresolved
Info

Default Admin Role Security

I-01The `DEFAULT_ADMIN_ROLE` in `AccessControl` has the power to grant and revoke any other role, including itself. Compromise of an account holding this role would grant an attacker full control over the contract's access control mechanisms, potentially leading to critical system compromise (7.3 Access Control, 7.8 Operations).
IssueThe `DEFAULT_ADMIN_ROLE` in `AccessControl` has the power to grant and revoke any other role, including itself. Compromise of an account holding this role would grant an attacker full control over the contract's access control mechanisms, potentially leading to critical system compromise (7.3 Access Control, 7.8 Operations).
FixThe address assigned to `DEFAULT_ADMIN_ROLE` should be a highly secured multi-signature wallet. Consider implementing a time-lock for critical operations performed by this role to provide a window for intervention.
StatusUnresolved
Info

Role Granularity and Least Privilege

I-02While `AccessControl` provides a robust framework, the security of the system heavily depends on how roles are defined and assigned in the inheriting `SpaceIDToken` contract. Over-permissioning accounts can lead to unintended access to sensitive functions (7.3 Access Control).
IssueWhile `AccessControl` provides a robust framework, the security of the system heavily depends on how roles are defined and assigned in the inheriting `SpaceIDToken` contract. Over-permissioning accounts can lead to unintended access to sensitive functions (7.3 Access Control).
FixAdhere strictly to the principle of least privilege. Each role should have only the minimum permissions necessary to perform its designated tasks. Regularly review role assignments and revoke unnecessary permissions.
StatusUnresolved
Info

Event Monitoring for Role Changes

I-03The `AccessControl` contract explicitly states that it does not allow enumerating role members except through off-chain means by accessing contract event logs. This means that active monitoring of `RoleGranted`, `RoleRevoked`, and `RoleAdminChanged` events is crucial for maintaining an accurate understanding of current permissions (7.8 Operations).
IssueThe `AccessControl` contract explicitly states that it does not allow enumerating role members except through off-chain means by accessing contract event logs. This means that active monitoring of `RoleGranted`, `RoleRevoked`, and `RoleAdminChanged` events is crucial for maintaining an accurate understanding of current permissions (7.8 Operations).
FixImplement robust off-chain monitoring systems to track all role-related events. This allows for timely detection of unauthorized role changes or misconfigurations, enhancing operational security.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The provided code is the OpenZeppelin `AccessControl` library, which implements a robust role-based access control system (7.3 Access Control). It is a well-audited and widely adopted standard, enhancing code security (7.2 Code Security) by restricting sensitive functions. However, the absence of the main `SpaceIDToken` contract prevents a full assessment of its specific implementation and potential vulnerabilities arising from custom logic or misconfigurations.

GovernanceHigh1/10

A comprehensive assessment of economic (7.4 Economic) and governance (7.5 Governance) risks is not possible as the core `SpaceIDToken` contract logic was not provided. The `AccessControl` contract itself does not introduce specific economic or governance mechanisms beyond role management. Proper configuration of roles in the inheriting contract is crucial for governance.

UpgradesHigh3/10

The provided `AccessControl` contract is not designed as an upgradeable proxy (7.7 Upgrades). The prefill indicates `is_proxy: false` for the main contract. If the `SpaceIDToken` were to be upgradeable, the upgrade mechanism itself would require a separate audit to ensure safety and proper state migration.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass

Holder Composition

88.7% in top 10
63.4% in wallets25.2% in contracts
Effective Concentration73.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$597.1K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder50.2%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0xe229…c495
Unlocked LP Held By
0xdbb2…7b8e0x375f…9491

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

7 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70% (88.7% total → 73.5% effective; 63.4% in EOAs, 25.2% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 50.2% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
USDS Stablecoin (USDS)High RiskMarlin POND (POND)High RiskSushiToken (SUSHI)High RiskEspresso (ESP)High RiskSEIHigh RiskDolomite (DOLO)High Risk

Would You Like a More Detailed Audit of SPACE ID?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit