On-chain security analysis — is it a scam or legit?
The StockifyToken contract implements an ERC20 token with a custom holder tracking mechanism.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x2a20…4c710x8984…202f0xb3f8…1a140xed21…f033A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.
minShareBalance and manually rewardsExcluded addresses. These functions directly influence which addresses are included in the _holders array. If this array is used for critical functions such as reward distribution, voting, or whitelisting, the owner possesses significant centralized control over these mechanisms, which could be abused to exclude legitimate holders or include favored addresses.H-01The contract owner has the ability to set minShareBalance and manually rewardsExcluded addresses. These functions directly influence which addresses are included in the _holders array. If this array is used for critical functions such as reward distribution, voting, or whitelisting, the owner possesses significant centralized control over these mechanisms, which could be abused to exclude legitimate holders or include favored addresses.
Consider decentralizing control over these parameters, perhaps through a multi-signature wallet, a time-locked contract, or a robust governance mechanism. Clearly document the intended use of the _holders array and the implications of owner control for all stakeholders.
Unresolved
setMinShareBalance and setRewardsExcluded functions, potentially manipulating the holder list and any associated protocol mechanics.L-01The contract owner is an Externally Owned Account (EOA). If the private key for this EOA is compromised, an attacker could gain full control over the setMinShareBalance and setRewardsExcluded functions, potentially manipulating the holder list and any associated protocol mechanics.
Transfer ownership to a multi-signature wallet or a robust governance contract to mitigate the single point of failure risk associated with an EOA owner.
Unresolved
MIN_SHARE_BALANCE_FLOOR and MIN_SHARE_BALANCE_CEILINGMIN_SHARE_BALANCE_FLOOR and MIN_SHARE_BALANCE_CEILING constants are hardcoded in the contract. While this provides a bounded range for minShareBalance, it means the range itself cannot be adjusted without a contract redeployment. If future protocol needs require a different range, a new contract deployment would be necessary.I-01The MIN_SHARE_BALANCE_FLOOR and MIN_SHARE_BALANCE_CEILING constants are hardcoded in the contract. While this provides a bounded range for minShareBalance, it means the range itself cannot be adjusted without a contract redeployment. If future protocol needs require a different range, a new contract deployment would be necessary.
If flexibility is desired in the future, consider making these bounds configurable by the owner or governance. Otherwise, acknowledge that any changes to these limits would necessitate a new contract deployment.
Unresolved
The StockifyToken contract implements an ERC20 token with a custom holder tracking mechanism. The contract is generally well-structured and uses OpenZeppelin libraries. Key functionalities include owner-controlled adjustments to minimum share balance and exclusion from rewards. The primary risks identified relate to the centralized control over key parameters and the use of an EOA for ownership.
The StockifyToken contract demonstrates strong technical foundations, leveraging battle-tested OpenZeppelin ERC20 and Ownable implementations. The custom _syncHolder logic for managing the _holders array is efficiently implemented using a 'swap-with-last' method, preventing gas-related denial-of-service issues (7.2 Code Security). Robust zero-address checks and custom error handling are present. However, the owner's EOA introduces a single point of failure for critical functions (7.3 Access Control, 7.8 Operations).
The economic model is based on a fixed total supply ERC20 token. The owner has significant control over parameters that define who is considered a 'holder' (7.4 Economic). Specifically, the minShareBalance can be adjusted within a predefined range, and addresses can be manually rewardsExcluded by the owner (7.5 Governance). This centralization introduces a potential single point of failure and could be exploited if the owner's key is compromised or acts maliciously, impacting the integrity of any reward or governance mechanisms tied to the holder list.
The contract is not designed as an upgradeable proxy, meaning its logic cannot be modified post-deployment. This design choice eliminates upgrade-related risks such as proxy misconfigurations or logic bugs introduced during upgrades (7.7 Upgrades). Any future changes would require a new deployment, ensuring immutability of the current implementation.
To enhance the security posture, consider transitioning the contract ownership from an EOA to a multi-signature wallet or a robust governance contract.
This decentralizes control and mitigates the risk associated with a single point of failure. Additionally, clearly document the intended use and implications of the _holders array and the owner's control over its parameters to ensure transparency for users and stakeholders.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Stockify (STFY) contract on Base is 0xc6405d7a226e1c18e559be2f335f74c01ad07bf5. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Stockify is 35/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Sep 4, 2026). Total DEX liquidity: $96.5K.
As of Sep 4, 2026, the 10 largest holders own 26.2% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
