On-chain security analysis — is it a scam or legit?
EthereumThis audit focused solely on the OpenZeppelin AccessControl.sol library contract, which is a dependency for the SpaceIDToken contract.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xdbb2…7b8e0x375f…9491No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
AccessControl contract itself does not inherently include time-lock mechanisms for sensitive operations like grantRole or revokeRole. Without a time-lock, critical changes can be executed immediately, leaving no window for community or governance intervention in case of a compromised key or malicious action (7.5 Governance, 7.8 Operations).L-01The AccessControl contract itself does not inherently include time-lock mechanisms for sensitive operations like grantRole or revokeRole. Without a time-lock, critical changes can be executed immediately, leaving no window for community or governance intervention in case of a compromised key or malicious action (7.5 Governance, 7.8 Operations).
For critical roles, especially the DEFAULT_ADMIN_ROLE, consider implementing a separate time-lock contract that acts as an intermediary for executing sensitive AccessControl functions. This introduces a delay, allowing for review and potential cancellation of malicious or erroneous operations.
Unresolved
DEFAULT_ADMIN_ROLE in AccessControl has the power to grant and revoke any other role, including itself. Compromise of an account holding this role would grant an attacker full control over the contract's access control mechanisms, potentially leading to critical system compromise (7.3 Access Control, 7.8 Operations).I-01The DEFAULT_ADMIN_ROLE in AccessControl has the power to grant and revoke any other role, including itself. Compromise of an account holding this role would grant an attacker full control over the contract's access control mechanisms, potentially leading to critical system compromise (7.3 Access Control, 7.8 Operations).
The address assigned to DEFAULT_ADMIN_ROLE should be a highly secured multi-signature wallet. Consider implementing a time-lock for critical operations performed by this role to provide a window for intervention.
Unresolved
AccessControl provides a robust framework, the security of the system heavily depends on how roles are defined and assigned in the inheriting SpaceIDToken contract. Over-permissioning accounts can lead to unintended access to sensitive functions (7.3 Access Control).I-02While AccessControl provides a robust framework, the security of the system heavily depends on how roles are defined and assigned in the inheriting SpaceIDToken contract. Over-permissioning accounts can lead to unintended access to sensitive functions (7.3 Access Control).
Adhere strictly to the principle of least privilege. Each role should have only the minimum permissions necessary to perform its designated tasks. Regularly review role assignments and revoke unnecessary permissions.
Unresolved
AccessControl contract explicitly states that it does not allow enumerating role members except through off-chain means by accessing contract event logs. This means that active monitoring of RoleGranted, RoleRevoked, and RoleAdminChanged events is crucial for maintaining an accurate understanding of current permissions (7.8 Operations).I-03The AccessControl contract explicitly states that it does not allow enumerating role members except through off-chain means by accessing contract event logs. This means that active monitoring of RoleGranted, RoleRevoked, and RoleAdminChanged events is crucial for maintaining an accurate understanding of current permissions (7.8 Operations).
Implement robust off-chain monitoring systems to track all role-related events. This allows for timely detection of unauthorized role changes or misconfigurations, enhancing operational security.
Unresolved
This audit focused solely on the OpenZeppelin AccessControl.sol library contract, which is a dependency for the SpaceIDToken contract. No custom logic for SpaceIDToken was provided for review, thus a comprehensive security assessment of the entire protocol cannot be performed. The AccessControl library itself is well-tested and widely used.
The provided code is the OpenZeppelin AccessControl library, which implements a robust role-based access control system (7.3 Access Control). It is a well-audited and widely adopted standard, enhancing code security (7.2 Code Security) by restricting sensitive functions. However, the absence of the main SpaceIDToken contract prevents a full assessment of its specific implementation and potential vulnerabilities arising from custom logic or misconfigurations.
A comprehensive assessment of economic (7.4 Economic) and governance (7.5 Governance) risks is not possible as the core SpaceIDToken contract logic was not provided. The AccessControl contract itself does not introduce specific economic or governance mechanisms beyond role management. Proper configuration of roles in the inheriting contract is crucial for governance.
The provided AccessControl contract is not designed as an upgradeable proxy (7.7 Upgrades). The prefill indicates is_proxy: false for the main contract. If the SpaceIDToken were to be upgradeable, the upgrade mechanism itself would require a separate audit to ensure safety and proper state migration.
Ensure that the DEFAULT_ADMIN_ROLE and other critical roles in the SpaceIDToken contract are secured with multi-signature wallets and, ideally, time-locks for sensitive operations.
Implement the principle of least privilege when assigning roles to prevent over-permissioning. Conduct a full security audit of the SpaceIDToken contract's custom logic to identify specific vulnerabilities related to its business logic, tokenomics, and interactions with other protocols.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
