Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Strategy PP Variable xStock Safe?

STRCXEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 31, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical9/10Governance9/10Upgrades6/10Checks passed3 of 7Findings7 Info7
SummaryAI Copilot

The protocol implements an upgradeable ERC-20 token with advanced fee and delegation features.

Read the full analysis
What raised the score
  • Issuer controls retained
Exact factors
  • Issuer controls retained (admin key, mint, upgrade, seize balances, pause) — counterparty risk on a known issuer, not a rug vector

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 313 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 31, 20264,944 holders
73.8%Contracts25.6%Wallets
73.8%Contracts25.6%Wallets
ContractsWalletsEveryone elseBubble area = share of supply
99.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking73.8%
  • Walletsanonymous holders, free to sell25.6%
  • Everyone else4,934 holders0.6%
Effective concentrationwhat the score reads55.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 31, 2026

Liquidity

as of audit · Oct 31$136.9K across 7 pairs
Show 1 more pair

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$115.1KShare of depth84.1%
Top-1 Unlocked Holder93.1%
Top-3 Unlocked100.0%
Unlocked LP held by
0xc6dd…7aa70x8481…ceac0x8ef6…2e380xcb9c…c4e7

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

7 Info
Info

Centralized Minting Authority

Privileged roles (minter, multiplier updater, owner) can mint new tokens, which dilutes the value of existing holdings. This is a significant centralization risk as the total supply is not fixed.CP-01

Issue

Privileged roles (minter, multiplier updater, owner) can mint new tokens, which dilutes the value of existing holdings. This is a significant centralization risk as the total supply is not fixed.

Fix

Implement a timelock for minting operations and define clear, transparent rules for when and why new tokens are minted.

Status

Unresolved

Info

Privileged Balance Manipulation

The 'delegatedTransfer' function allows addresses on the 'delegateWhitelist' to move tokens from any user's account. This is a high-risk function that could lead to total loss of funds if a whitelisted address is compromised.CP-02

Issue

The 'delegatedTransfer' function allows addresses on the 'delegateWhitelist' to move tokens from any user's account. This is a high-risk function that could lead to total loss of funds if a whitelisted address is compromised.

Fix

Restrict the use of 'delegatedTransfer' to only essential services and implement strict monitoring for any activity involving this function.

Status

Unresolved

Info

Centralized Pause Control

The 'pauser' role can halt all token transfers at any time. This prevents users from moving their assets, which could be used to freeze funds during an emergency or maliciously.CP-04

Issue

The 'pauser' role can halt all token transfers at any time. This prevents users from moving their assets, which could be used to freeze funds during an emergency or maliciously.

Fix

Limit the pause functionality to specific emergency scenarios and ensure the pauser role is held by a secure, multi-signature wallet.

Status

Unresolved

Info

Who holds the supply

The ten largest holders own 99.4% of supply. What remains: 25.6% in wallets, 73.8% in other contracts. 4,944 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.QA-HOLDERS

Issue

The ten largest holders own 99.4% of supply. What remains: 25.6% in wallets, 73.8% in other contracts. 4,944 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Identity verified by independent sources

Listed on CoinGecko as Strategy PP Variable xStock (STRCX), market cap $151M, rank #207. Its owner (0x4975…3a65) controls 119 issuer-backed coins CoinGecko lists on ethereum, $949M together, among them MicroStrategy xStock, Circle xStock, SpaceX xStock: one issuer's programme, read on-chain. 4,944 holders. Verified by: CoinGecko, issuer programme.QA-IDENTITY

Issue

Listed on CoinGecko as Strategy PP Variable xStock (STRCX), market cap $151M, rank #207. Its owner (0x4975…3a65) controls 119 issuer-backed coins CoinGecko lists on ethereum, $949M together, among them MicroStrategy xStock, Circle xStock, SpaceX xStock: one issuer's programme, read on-chain. 4,944 holders. Verified by: CoinGecko, issuer programme.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $137K (DexScreener, all pools). 24h trading volume $6.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $292K (DexScreener, all pools).QA-MARKET

Issue

Liquidity $137K (DexScreener, all pools). 24h trading volume $6.8M (CoinGecko, all markets, daily snapshot). 24h trading volume $292K (DexScreener, all pools).

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Tokenized real-world asset

A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: a 2-of-3 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $137K of DEX liquidity across 7 pools. Launch: 163 days of market history.QA-PROFILE

Issue

A token backed by an off-chain asset (a stock, gold, treasury bills, a fund share) held by a named issuer or custodian. Issuance, redemption and transfer restrictions are the issuer's by design. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Tokenized Stocks. Tokenomics — Supply: issued and redeemed by the issuer against its backing. Control: a 2-of-3 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $137K of DEX liquidity across 7 pools. Launch: 163 days of market history.

Fix

Treat the issuer or custodian as the counterparty: check its custody reports and who may hold or redeem the token.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 31
Executive SummaryWhat the contract is and what the review found

The protocol implements an upgradeable ERC-20 token with advanced fee and delegation features. While the architecture follows standard OpenZeppelin patterns, the contract grants significant centralized control to privileged roles, including the ability to mint tokens, pause transfers, and perform delegated transfers on behalf of users. Users should be aware that these administrative powers represent a high degree of centralization risk.

Technical9/10Low risk

The contract utilizes a robust UUPS/Transparent proxy pattern for upgradeability and standard ERC-20 compliance. 7.1 Architecture: Modular design separating logic from state. 7.2 Code Security: Implementation follows established patterns, though complex fee logic increases surface area. 7.3 Access Control: Highly centralized with multiple administrative roles (minter, pauser, delegateWhitelist). 7.6 External: Integration with external sanctions lists is implemented safely.

Governance9/10Low risk

7.4 Economic: The token supply is elastic, controlled by the minter and multiplier updater roles. 7.5 Governance: Administrative control is held by a multisig, providing a layer of protection against single-point-of-failure. 7.8 Operations: The protocol relies on off-chain coordination for fee updates and multiplier adjustments.

Upgrades6/10Medium risk

7.7 Upgrades: The contract uses a standard Transparent Proxy pattern managed by a dedicated ProxyAdmin. Upgrades are controlled by a multisig, ensuring that changes to the implementation require consensus. The separation of proxy and implementation is correctly configured.

Final RecommendationWhat to do about this score

The protocol should implement a timelock contract for all administrative actions, particularly those involving minting or changing fee parameters, to provide transparency and a window for users to react.

Additionally, consider reducing the scope of the 'delegateWhitelist' role to minimize the impact of a potential compromise of these addresses. Regularly audit the addresses assigned to privileged roles to ensure they remain secure and under the control of the intended multisig. Ensure that the 'sanctionsList' contract is maintained by a reputable entity to prevent arbitrary blocking of legitimate users.

Contract & Record

1 audit on record
TypeBackedTokenProxy
NetworkEthereum
Token age5mo
Contract0x1aad…77f3
Deployer0x5f7a…a2ad
Proxy Upgrade Controls
Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin → Multisig 2-of-3
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Strategy PP Variable xStock security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Oct 31, 20269Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the STRCX contract address?

The Strategy PP Variable xStock (STRCX) contract on Ethereum is 0x1aad217b8f78dba5e6693460e8470f8b1a3977f3. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Strategy PP Variable xStock a scam?

Quantum Audit's risk score for Strategy PP Variable xStock is 9/100 (Low risk) as of Oct 31, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is STRCX liquidity locked?

Liquidity lock: Not locked (as of Oct 31, 2026). Total DEX liquidity: $136.9K.

Who holds STRCX?

As of Oct 31, 2026, the 10 largest holders own 99.4% of the supply across 4,944 holders. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Re Protocol reUSDREUSD · Ethereum9LowGlobal DollarUSDG · Ethereum8LowTether GoldXAUT · Ethereum10LowsatoEthereum7LowAaveEthereum11LowFuseEthereum6Low

Would You Like a More Detailed Audit of Strategy PP Variable xStock?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Add your links and get it Verified