Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is SpaceX Safe?

SPCXBBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades1/10Checks passed1 of 5Findings1 High · 1 Medium · 1 Low · 1 Info4
SummaryAI Copilot

The SecuritiesToken contract implements an upgradeable ERC-20 token with compliance, pausing, and a scaled UI multiplier mechanism.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Complex proxy pattern
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Complex proxy pattern (BEACON)
  • Top-10 concentration > 70% (86.9% total → 84.1% effective; 82.3% in EOAs, 4.6% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 41 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
4.6%82.3%Wallets13.1%Everyone else
4.6%82.3%Wallets13.1%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
86.9%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking4.6%
  • Walletsanonymous holders, free to sell82.3%
  • Everyone elsethe rest of the supply13.1%
Effective concentrationwhat the score reads84.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$6.23M across 16 pairs
Show 4 more pairs

The 6 remaining pairs hold $985 between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$2.22MShare of depth35.7%
Top-1 Unlocked Holder49.7%
Top-3 Unlocked77.0%
Unlocked LP held by
0x556b…d59e0xf949…02980xe63b…34b40x2fc7…5e3f0xf33b…b2f10x84a4…dee60xef6e…cce70x4686…f0050x2216…1e930x755a…2c89

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium1 Low1 Info
High

Centralized Control over Critical Functions and External Dependencies

The DEFAULT_ADMIN_ROLE possesses extensive control over the SecuritiesToken contract. This role can change the addresses of the ComplianceClient and PauseManagerClient contracts, enable/disable minting and burning, and authorize UI multiplier updates. This level of centralization means that a compromise or malicious action by a single administrator could lead to a complete system takeover, including disabling compliance, pausing all operations, or manipulating the token supply and value.H-01

Issue

The DEFAULT_ADMIN_ROLE possesses extensive control over the SecuritiesToken contract. This role can change the addresses of the ComplianceClient and PauseManagerClient contracts, enable/disable minting and burning, and authorize UI multiplier updates. This level of centralization means that a compromise or malicious action by a single administrator could lead to a complete system takeover, including disabling compliance, pausing all operations, or manipulating the token supply and value.

Fix

Implement a multi-signature wallet (e.g., Gnosis Safe) for the DEFAULT_ADMIN_ROLE to require multiple approvals for critical operations, such as changing external contract addresses or modifying core token parameters. Consider time-locks for highly sensitive actions to provide a window for community review or emergency intervention.

Status

Unresolved

Medium

Wide UI Multiplier Range with Potential Economic Impact

The _validateMultiplier function allows the UI multiplier to be set within an extremely wide range, from 1e9 (0.000000001x) to 1e27 (1,000,000,000x). While controlled by privileged roles (DEFAULT_ADMIN_ROLE or ISSUER_ROLE) and limited to 365 days in the future, such drastic changes in the multiplier could significantly impact the token's perceived value and user balances, potentially leading to economic instability or unexpected behavior if not managed with extreme care.M-01

Issue

The _validateMultiplier function allows the UI multiplier to be set within an extremely wide range, from 1e9 (0.000000001x) to 1e27 (1,000,000,000x). While controlled by privileged roles (DEFAULT_ADMIN_ROLE or ISSUER_ROLE) and limited to 365 days in the future, such drastic changes in the multiplier could significantly impact the token's perceived value and user balances, potentially leading to economic instability or unexpected behavior if not managed with extreme care.

Fix

Review the intended economic model and consider if such a wide multiplier range is truly necessary. If not, narrow the allowed range to reduce the potential for extreme value fluctuations. Implement a more robust governance process or a time-locked delay for multiplier changes, especially for significant adjustments, to allow stakeholders to react.

Status

Unresolved

Low

Reliance on External Contract Security

The SecuritiesToken contract heavily relies on the ComplianceClientUpgradeable and PauseManagerClientUpgradeable for critical functionality, including transaction validation and pausing mechanisms. The security and correct functioning of these external contracts are paramount to the overall integrity of the token. Any vulnerabilities or malicious implementations within these external dependencies could directly compromise the SecuritiesToken.L-01

Issue

The SecuritiesToken contract heavily relies on the ComplianceClientUpgradeable and PauseManagerClientUpgradeable for critical functionality, including transaction validation and pausing mechanisms. The security and correct functioning of these external contracts are paramount to the overall integrity of the token. Any vulnerabilities or malicious implementations within these external dependencies could directly compromise the SecuritiesToken.

Fix

Ensure that the ComplianceClientUpgradeable and PauseManagerClientUpgradeable contracts have undergone thorough security audits. Implement robust monitoring for these external contracts to detect any unexpected behavior or changes. Consider adding mechanisms to gracefully handle failures or unexpected returns from these external calls, if applicable.

Status

Unresolved

Info

Significant Power of ISSUER_ROLE

The ISSUER_ROLE has the authority to mint and burn tokens, as well as to authorize UI multiplier updates. This grants significant power over the token's supply and economic parameters. While this is likely an intended design, it highlights the importance of securing the keys associated with this role.I-01

Issue

The ISSUER_ROLE has the authority to mint and burn tokens, as well as to authorize UI multiplier updates. This grants significant power over the token's supply and economic parameters. While this is likely an intended design, it highlights the importance of securing the keys associated with this role.

Fix

Ensure that all addresses assigned the ISSUER_ROLE are managed with the highest security standards, potentially using multi-signature wallets or hardware security modules. Implement strict operational procedures and access controls around these privileged accounts.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The SecuritiesToken contract implements an upgradeable ERC-20 token with compliance, pausing, and a scaled UI multiplier mechanism. It leverages OpenZeppelin's upgradeable patterns and access control. The contract demonstrates good adherence to upgradeability best practices and includes robust checks for initialization and token operations. However, the system exhibits significant centralization of control in the DEFAULT_ADMIN_ROLE and ISSUER_ROLE, particularly concerning the ability to modify critical external dependencies and economic parameters. The wide range allowed for the UI multiplier also presents a notable economic risk.

Technical6/10Medium risk

The technical architecture (7.1) is well-structured, utilizing OpenZeppelin's upgradeable contracts and a clear separation of concerns for compliance and pausing. Code security (7.2) is generally strong, with appropriate use of modifiers, error handling, and Solidity 0.8+ safety features. For example, _update includes comprehensive compliance checks for msg.sender, from, and to addresses. However, the reliance on external ComplianceClient and PauseManagerClient contracts (7.6) introduces a dependency risk, as their security directly impacts the token's integrity. No reentrancy or integer overflow/underflow vulnerabilities were identified.

Governance1/10High risk

Access control (7.3) is managed via AccessControlEnumerableUpgradeable, defining DEFAULT_ADMIN_ROLE and ISSUER_ROLE. The DEFAULT_ADMIN_ROLE holds significant power, including the ability to set ComplianceClient and PauseManagerClient addresses, enable/disable minting/burning, and authorize multiplier updates. This centralization (7.5) presents a single point of failure. Economically (7.4), the _validateMultiplier function allows a very wide range for the UI multiplier (1e-9x to 1e9x), which, while controlled by privileged roles, could lead to drastic token revaluation if misused. The ISSUER_ROLE also has substantial power to mint and burn tokens.

Upgrades1/10High risk

The contract is designed for upgradeability using the BeaconProxy pattern, with the provided code serving as the implementation. It correctly uses OpenZeppelin's initializer modifier and _disableInitializers() in the constructor to prevent re-initialization. The __gap storage variable is appropriately included to ensure future storage layout compatibility. The initialization logic for all inherited upgradeable contracts is correctly chained, demonstrating robust upgrade safety (7.7).

Final RecommendationWhat to do about this score

Strengthen the security posture by implementing multi-signature wallets for critical administrative roles, especially for the DEFAULT_ADMIN_ROLE which controls external contract addresses and core token parameters.

Carefully review the economic implications of the wide UI multiplier range and consider implementing a more granular or time-locked mechanism for significant changes. Ensure that all external dependencies, particularly the ComplianceClient and PauseManagerClient, undergo rigorous security audits.

Contract & Record

1 audit on record
TypeBeaconProxy
NetworkBNB Chain
Token age1mo
Contract0xbe9d…03e1
Deployer0x64fd…8d53
Proxy Upgrade Controls
Proxy TypeBeacon
ImplementationVerified source
Badge for your website
SpaceX security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202677High
  2. Aug 11, 202681High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the SPCXB contract address?

The SpaceX (SPCXB) contract on BNB Chain is 0xbe9d156892e55e7154bcd3cb0fea677f9d3103e1. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is SpaceX a scam?

Quantum Audit's risk score for SpaceX is 77/100 (High risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is SPCXB liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $6.23M.

Who holds SPCXB?

As of Sep 4, 2026, the 10 largest holders own 86.9% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Lorenzo Governance TokenBANK · BNB Chain77HighVenusCoinBNB Chain77HighBedrockBR · BNB Chain77HighCysic TokenCYS · BNB Chain77HighWorld Liberty Financial USDUSD1 · BNB Chain77HighSPABNB Chain77High

Would You Like a More Detailed Audit of SpaceX?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page