On-chain security analysis — is it a scam or legit?
The SquidToken contract implements a standard ERC-20 token with Permit functionality, leveraging battle-tested OpenZeppelin libraries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xfa2b…52bb0x85f9…ea620xfa8b…bca7No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
SquidToken contract is not designed to be upgradeable (7.7). While this simplifies the architecture (7.1) and removes upgrade-related risks, it implies that any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a potentially complex migration process for token holders. This is a design choice rather than a direct vulnerability.L-01The SquidToken contract is not designed to be upgradeable (7.7). While this simplifies the architecture (7.1) and removes upgrade-related risks, it implies that any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a potentially complex migration process for token holders. This is a design choice rather than a direct vulnerability.
Acknowledge the implications of immutability. For future projects requiring flexibility, consider implementing an upgradeable proxy pattern. For this specific contract, ensure that the initial design is thoroughly reviewed to minimize the need for future changes.
Unresolved
permit function, while a standard feature of ERC-20 Permit, can be susceptible to front-running attacks (7.2, 7.4). A malicious actor could observe a signed permit transaction waiting in the mempool and submit their own transaction with a higher gas price to execute the permit before the legitimate user. This could allow the attacker to manipulate the allowance set by the owner for the spender, potentially leading to unexpected behavior or loss of funds if not handled carefully off-chain. This is an inherent characteristic of the ERC-20 Permit standard and not a flaw in the implementation itself.L-02The permit function, while a standard feature of ERC-20 Permit, can be susceptible to front-running attacks (7.2, 7.4). A malicious actor could observe a signed permit transaction waiting in the mempool and submit their own transaction with a higher gas price to execute the permit before the legitimate user. This could allow the attacker to manipulate the allowance set by the owner for the spender, potentially leading to unexpected behavior or loss of funds if not handled carefully off-chain. This is an inherent characteristic of the ERC-20 Permit standard and not a flaw in the implementation itself.
Educate users about the potential for front-running when using the permit function. Recommend using private transaction relays or services that offer front-running protection where available. Implement off-chain mechanisms to mitigate this risk if the application relies heavily on permit functionality.
Unresolved
The SquidToken contract leverages battle-tested and widely audited OpenZeppelin libraries for its core ERC-20 and ERC-20 Permit functionality. This significantly reduces the likelihood of common vulnerabilities associated with custom implementations of these standards, contributing to a high level of code security (7.2).
Continue to rely on well-vetted libraries for core functionalities. Regularly monitor OpenZeppelin's security advisories and updates.
Unresolved
The SquidToken contract implements a standard ERC-20 token with Permit functionality, leveraging battle-tested OpenZeppelin libraries. The codebase is minimal and straightforward, contributing to a low-risk profile. No critical or high-severity vulnerabilities were identified.
The technical architecture (7.1) is robust, relying on well-audited OpenZeppelin ERC-20 and ERC-20 Permit implementations. Code security (7.2) is high due to minimal custom logic and adherence to established patterns, with proper checks in the constructor for recipient and initialSupply. Access control (7.3) is standard for an ERC-20 token, with no additional privileged roles beyond the initial deployer for minting. No reentrancy or integer overflow/underflow vulnerabilities were found.
The economic model (7.4) is that of a simple ERC-20 token, without complex mechanisms or external dependencies that could introduce economic exploits. There is no explicit governance (7.5) mechanism implemented within the contract. The primary economic risk identified is the inherent front-running potential of the permit function, which is a known characteristic of the standard.
The contract is not designed to be upgradeable (7.7), which simplifies its architecture and eliminates upgrade-related risks such as proxy misconfigurations or storage collisions. This design choice means that any future changes or bug fixes would require a new deployment and token migration, which is a common approach for simple token contracts. Operations (7.8) are straightforward, as the contract has no complex operational dependencies.
It is recommended to maintain a clear understanding of the implications of the contract's immutability, especially regarding future feature enhancements or bug fixes.
For the permit function, users should be educated on potential front-running risks and encouraged to use secure transaction submission methods. Ensure all external interactions, if any, are carefully vetted for security best practices.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
