On-chain security analysis — is it a scam or legit?
BNB ChainThe SecuritiesToken is an upgradeable ERC-20 implementation designed for regulated asset issuance.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Nov 7, 2026
The 3 remaining pairs hold $202 between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x556b…d59e0x33b8…bacc0x8145…09920x57a8…26150x08d6…bca20x16e8…21da0xb9d0…5fdb0xb05a…85990xf293…067f0xdca1…8a38No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The functions setPauseManager and setCompliance allow a privileged address to replace the contracts that govern token transfers. This means an administrator can unilaterally change the rules of the token, including pausing all transfers or altering compliance requirements.
Transition the administrative role to a multi-signature wallet or a decentralized governance contract to prevent single-point-of-failure risks.
Unresolved
The setUIMultiplier function allows a privileged address to modify the transfer fee structure. This gives the controller the ability to change the cost of moving tokens at any time.
Consider implementing a maximum fee cap or a time-lock mechanism for fee changes to provide transparency and protection to token holders.
Unresolved
The setUIMultiplier function also influences numeric limits checked during transfers. A privileged address can adjust these thresholds, potentially restricting or enabling specific transaction sizes.
Document the intended range for these limits and provide public visibility into any changes made to these parameters.
Unresolved
The ten largest holders own 95.2% of supply. What remains: 95.2% in wallets, 0.0% in other contracts. 9,948 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Strategy (bStocks Tokenized Stock) (MSTRB), market cap $47M, rank #454. Its admin (0x45e3…679d) controls 105 issuer-backed coins CoinGecko lists on bsc, $1.2B together, among them SpaceX (bStocks Tokenized Stock), Circle Internet Group (bStocks Tokenized Stock), Alphabet (bStocks Tokenized Stock): one issuer's programme, read on-chain. 9,948 holders. Verified by: issuer programme.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $382K (DexScreener, all pools). 24h trading volume $25.2M (CoinGecko, all markets, daily snapshot). 24h trading volume $324K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $382K of DEX liquidity across 13 pools. Launch: 88 days of market history.
Treat the issuer or custodian as the counterparty: check its custody reports and who may hold or redeem the token.
Acknowledged
The SecuritiesToken is an upgradeable ERC-20 implementation designed for regulated asset issuance. It utilizes a robust role-based access control system and external compliance/pause modules. While the architecture is modular, the high degree of centralized control over core logic and transfer parameters introduces significant trust requirements for token holders.
The architecture (7.1) follows standard UUPS/Beacon proxy patterns, ensuring upgradeability. Code security (7.2) is high, utilizing OpenZeppelin libraries for standard ERC-20 and AccessControl. Access control (7.3) is strictly enforced via roles, though the reliance on external contracts for compliance and pausing (7.6) creates a dependency risk.
Economic parameters (7.4) such as UI multipliers and minting are fully controlled by privileged roles. Governance (7.5) is currently centralized, meaning token holders have no direct influence over protocol changes. This design is typical for regulated securities but requires high trust in the issuer.
Upgrades (7.7) are managed via the Beacon proxy pattern, allowing for seamless logic updates. Operations (7.8) are supported by pause and compliance modules that can be swapped. The primary risk is the potential for malicious logic injection during an upgrade if the admin keys are compromised.
Implement a multi-signature wallet or a time-locked governance contract to manage the privileged roles.
This will mitigate the risk of a single compromised key performing unauthorized changes to compliance, pause, or fee settings. Ensure that all external compliance and pause contracts are audited and their source code is verified. Regularly monitor the state of these external dependencies to ensure they continue to function as intended within the token's transfer flow.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Strategy Inc. (MSTRB) contract on BNB Chain is 0xe87afb3076aeb0f9b14e368de8145ae6a2826a14. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Strategy Inc. is 9/100 (Low risk) as of Nov 7, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Nov 7, 2026). Total DEX liquidity: $382.2K.
As of Nov 7, 2026, the 10 largest holders own 95.2% of the supply across 9,948 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
