Quantum Audit Logo

Is Stockify Safe?

On-chain security analysis — is it a scam or legit?

Stockify STFY
0xc640…7bf5
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The StockifyToken contract implements an ERC20 token with a custom holder tracking mechanism. The contract is generally well-structured and uses OpenZeppelin libraries. Key functionalities include owner-controlled adjustments to minimum share balance and exclusion from rewards. The primary risks identified relate to the centralized control over key parameters and the use of an EOA for ownership.

1 High1 Low1 Informational
Volume 24h
$128.7K
Liquidity
$92.1K
Price
$0.0006683
Token Age
10d
Top 10 Holders
26.2%

Security Findings

1 High1 Low1 Info
High

Centralized Control over Holder List Parameters

H-01The contract owner has the ability to set `minShareBalance` and manually `rewardsExcluded` addresses. These functions directly influence which addresses are included in the `_holders` array. If this array is used for critical functions such as reward distribution, voting, or whitelisting, the owner possesses significant centralized control over these mechanisms, which could be abused to exclude legitimate holders or include favored addresses.
IssueThe contract owner has the ability to set `minShareBalance` and manually `rewardsExcluded` addresses. These functions directly influence which addresses are included in the `_holders` array. If this array is used for critical functions such as reward distribution, voting, or whitelisting, the owner possesses significant centralized control over these mechanisms, which could be abused to exclude legitimate holders or include favored addresses.
FixConsider decentralizing control over these parameters, perhaps through a multi-signature wallet, a time-locked contract, or a robust governance mechanism. Clearly document the intended use of the `_holders` array and the implications of owner control for all stakeholders.
StatusUnresolved
Low

Owner EOA Risk

L-01The contract owner is an Externally Owned Account (EOA). If the private key for this EOA is compromised, an attacker could gain full control over the `setMinShareBalance` and `setRewardsExcluded` functions, potentially manipulating the holder list and any associated protocol mechanics.
IssueThe contract owner is an Externally Owned Account (EOA). If the private key for this EOA is compromised, an attacker could gain full control over the `setMinShareBalance` and `setRewardsExcluded` functions, potentially manipulating the holder list and any associated protocol mechanics.
FixTransfer ownership to a multi-signature wallet or a robust governance contract to mitigate the single point of failure risk associated with an EOA owner.
StatusUnresolved
Info

Fixed `MIN_SHARE_BALANCE_FLOOR` and `MIN_SHARE_BALANCE_CEILING`

I-01The `MIN_SHARE_BALANCE_FLOOR` and `MIN_SHARE_BALANCE_CEILING` constants are hardcoded in the contract. While this provides a bounded range for `minShareBalance`, it means the range itself cannot be adjusted without a contract redeployment. If future protocol needs require a different range, a new contract deployment would be necessary.
IssueThe `MIN_SHARE_BALANCE_FLOOR` and `MIN_SHARE_BALANCE_CEILING` constants are hardcoded in the contract. While this provides a bounded range for `minShareBalance`, it means the range itself cannot be adjusted without a contract redeployment. If future protocol needs require a different range, a new contract deployment would be necessary.
FixIf flexibility is desired in the future, consider making these bounds configurable by the owner or governance. Otherwise, acknowledge that any changes to these limits would necessitate a new contract deployment.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The StockifyToken contract demonstrates strong technical foundations, leveraging battle-tested OpenZeppelin ERC20 and Ownable implementations. The custom `_syncHolder` logic for managing the `_holders` array is efficiently implemented using a 'swap-with-last' method, preventing gas-related denial-of-service issues (7.2 Code Security). Robust zero-address checks and custom error handling are present. However, the owner's EOA introduces a single point of failure for critical functions (7.3 Access Control, 7.8 Operations).

GovernanceMedium5/10

The economic model is based on a fixed total supply ERC20 token. The owner has significant control over parameters that define who is considered a 'holder' (7.4 Economic). Specifically, the `minShareBalance` can be adjusted within a predefined range, and addresses can be manually `rewardsExcluded` by the owner (7.5 Governance). This centralization introduces a potential single point of failure and could be exploited if the owner's key is compromised or acts maliciously, impacting the integrity of any reward or governance mechanisms tied to the holder list.

UpgradesLow7/10

The contract is not designed as an upgradeable proxy, meaning its logic cannot be modified post-deployment. This design choice eliminates upgrade-related risks such as proxy misconfigurations or logic bugs introduced during upgrades (7.7 Upgrades). Any future changes would require a new deployment, ensuring immutability of the current implementation.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedPass
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

26.2% in top 10
6.2% in wallets20.0% in contracts
Effective Concentration14.2%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$96.5K across 6 pairs
Uniswap v4ETHanalysed$92.1K95.4%Uniswap v4USDC$2.6K2.7%Uniswap v4BLUECHIP$1.1K1.1%Uniswap v4USDC$7020.7%Uniswap v4BLUECHIP$630.1%Uniswap v4USDC$160.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Locked86.2% · UNCX V4 Lock
Top-1 Unlocked Holder13.8%

Key Addresses

5 addresses
Deployer
0x2a20…4c71
Unlocked LP Held By
0x2a20…4c710x8984…202f0xb3f8…1a140xed21…f033

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

What Raised This Score

4 factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Token age < 30 days (still settling)
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Virtual Protocol (VIRTUAL)Medium RiskCookieMedium RiskBasepepeMedium RiskMoltbook (MOLT)Medium RiskKellyClaudeMedium RiskPlayMedium Risk

Would You Like a More Detailed Audit of Stockify?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit