Is Stockereum.fun (STOCKER) a Scam? New Token Security Check

Security Findings

2 Low1 Info

Low

Lack of Administrative Control

L-01The LaunchToken contract lacks any administrative functions or roles (e.g., owner, roles, pause, upgradeability). While this simplifies the contract and reduces attack surface, it means there is no mechanism to address potential future issues such as critical bugs, emergency pausing of transfers, or token migration without deploying an entirely new token. This design choice limits the project's flexibility and emergency response capabilities (7.3 Access Control, 7.8 Operations).

IssueThe LaunchToken contract lacks any administrative functions or roles (e.g., owner, roles, pause, upgradeability). While this simplifies the contract and reduces attack surface, it means there is no mechanism to address potential future issues such as critical bugs, emergency pausing of transfers, or token migration without deploying an entirely new token. This design choice limits the project's flexibility and emergency response capabilities (7.3 Access Control, 7.8 Operations).

FixConsider implementing a minimal set of administrative controls, such as an `Ownable` pattern, to allow for emergency pausing of transfers or a controlled burn function if future needs are anticipated. If the intention is for a fully immutable token, ensure this design choice aligns with the project's long-term strategy and risk tolerance.

StatusUnresolved

Low

Centralized Initial Supply Distribution

L-02The entire `TOTAL_SUPPLY` of 1 billion tokens is minted to a single `recipient` address during the contract's construction. This centralizes control of the initial token supply, making the project highly dependent on the security and integrity of that single address. Any compromise of this address would lead to the loss or unauthorized distribution of all tokens (7.4 Economic, 7.8 Operations).

IssueThe entire `TOTAL_SUPPLY` of 1 billion tokens is minted to a single `recipient` address during the contract's construction. This centralizes control of the initial token supply, making the project highly dependent on the security and integrity of that single address. Any compromise of this address would lead to the loss or unauthorized distribution of all tokens (7.4 Economic, 7.8 Operations).

FixTo mitigate the risk associated with a single point of failure, consider distributing the initial supply across multiple addresses or a multi-signature wallet. This enhances security by requiring multiple approvals for token movements, reducing the impact of a single private key compromise.

StatusUnresolved

Info

Immutability of `metadataUri`

I-01The `metadataUri` variable is set in the constructor and has no setter function, making it immutable after deployment. While this provides certainty and prevents unauthorized changes, it also means the token's metadata URI cannot be updated if the URI becomes invalid, needs to be changed for branding, legal, or technical reasons (e.g., IPFS hash update) (7.1 Architecture).

IssueThe `metadataUri` variable is set in the constructor and has no setter function, making it immutable after deployment. While this provides certainty and prevents unauthorized changes, it also means the token's metadata URI cannot be updated if the URI becomes invalid, needs to be changed for branding, legal, or technical reasons (e.g., IPFS hash update) (7.1 Architecture).

FixIf there's a potential future need to update the metadata URI, consider adding an owner-restricted function to modify this variable. If immutability is the desired design, ensure the initial URI is robust and points to a highly available and permanent storage solution.

StatusUnresolved

Category Ratings

TechnicalLow10/10

The technical implementation of the LaunchToken contract is robust, leveraging battle-tested OpenZeppelin ERC-20 libraries (7.2 Code Security). The contract adheres to the ERC-20 standard, ensuring compatibility with the broader EVM ecosystem. No reentrancy, integer overflow/underflow, or other critical code-level vulnerabilities were identified. The use of Solidity 0.8.26 and OpenZeppelin's `unchecked` blocks for arithmetic operations is appropriate for gas efficiency and safety.

GovernanceHigh2/10

The economic model features a fixed total supply of 1 billion tokens, all minted to a single recipient during deployment (7.4 Economic). This design choice centralizes initial token distribution, posing a risk if the recipient address is compromised (7.8 Operations). The contract lacks any on-chain governance mechanisms (7.5 Governance) or administrative controls, which limits flexibility for future adjustments or emergency responses.

UpgradesMedium6/10

The LaunchToken contract is implemented as a standard, non-upgradeable ERC-20 token (7.7 Upgrades). This design choice eliminates upgrade-related risks such as proxy implementation bugs or administrative key compromises for upgrades. However, it also means the contract's logic cannot be modified post-deployment, requiring a new deployment for any future changes.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

27.0% in top 10

12.6% in wallets14.4% in contracts

Effective Concentration18.3%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$147.8K across 12 pairs

Uniswap v4WETHanalysed$110.1K Uniswap v4USDC$28.4K Uniswap v4USDC$4.3K Uniswap v2WETH$1.1K Uniswap v4USDC$1.1K Uniswap v4USDC$837

Show 4 more pairsShow less

Uniswap v4USDC$837 Uniswap v4USDC$752 Uniswap v4USDC$330 Uniswap v4USDT$56

The 2 remaining pairs hold $55 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder55.9%

Top-3 Unlocked95.7%

Key Addresses

7 addresses

Deployer

0x400e…a4cc

Unlocked LP Held By

0x996d…ad770x7118…ce180x576c…0fa10xc7f8…67150xd7b0…db830x57d6…0acc

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors

Ownership status UNKNOWN (owner could not be resolved)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 55.9% (independent LP — depth risk, pool = 74% of DEX liquidity)
LP top3 unlocked holders = 95.7% (independent LP — depth risk, pool = 74% of DEX liquidity)
Token age < 7 days (early, volatile)
2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is Stockereum.fun a Scam?

Security Findings

Lack of Administrative Control

Centralized Initial Supply Distribution

Immutability of `metadataUri`

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of Stockereum.fun?