Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Subsquid Safe?

SQDArbitrum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades6/10Checks passed3 of 5Findings1 High · 1 Low · 1 Info3
SummaryAI Copilot

The SQD token contract is an ERC20 implementation based on OpenZeppelin's battle-tested library, deployed on Arbitrum.

Read the full analysis
What raised the score
  • Ownership not renounced
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced (admin/mint authority retained)
  • Top-10 concentration > 30% (53.1% total → 35.2% effective; 23.3% in EOAs, 29.8% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
29.8%Contracts23.3%Wallets46.9%Everyone else
29.8%Contracts23.3%Wallets46.9%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
53.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking29.8%
  • Walletsanonymous holders, free to sell23.3%
  • Everyone elsethe rest of the supply46.9%
Effective concentrationwhat the score reads35.2%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$351.8K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$351.6KShare of depth99.9%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0xf161…e9e10x6b9f…e9800xd883…b378

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Low1 Info
High

Centralized Control of Token Supply via L2 Gateway (External Dependency Risk)

The l2Gateway address has exclusive control over the bridgeMint and bridgeBurn functions, allowing it to arbitrarily increase or decrease the token supply. While this is a necessary design for a bridged token, it introduces a single, highly privileged point of control. The security of the entire SQD token's economic integrity on Arbitrum is directly dependent on the security and integrity of the l2Gateway contract. A compromise of the l2Gateway would lead to a critical economic impact, such as hyperinflation or complete draining of the token supply.H-01

Issue

The l2Gateway address has exclusive control over the bridgeMint and bridgeBurn functions, allowing it to arbitrarily increase or decrease the token supply. While this is a necessary design for a bridged token, it introduces a single, highly privileged point of control. The security of the entire SQD token's economic integrity on Arbitrum is directly dependent on the security and integrity of the l2Gateway contract. A compromise of the l2Gateway would lead to a critical economic impact, such as hyperinflation or complete draining of the token supply.

Fix

Implement the highest security standards for the l2Gateway contract, including robust access control (e.g., multi-signature wallet), thorough auditing, and continuous monitoring. Establish a clear and secure operational procedure for managing the l2Gateway to minimize the risk of compromise. Consider decentralizing control over time if feasible for the bridge architecture.

Status

Unresolved

Low

ERC20 approve Race Condition

The standard ERC20 approve function is susceptible to a known race condition. If a user approves an amount, and then approves a different amount before the first transaction is mined, an attacker could front-run the second approval to spend the original approved amount, and then the second approval would overwrite the allowance, potentially allowing the attacker to spend more than intended. This is an inherent characteristic of the ERC20 standard and not a flaw in the OpenZeppelin implementation.L-01

Issue

The standard ERC20 approve function is susceptible to a known race condition. If a user approves an amount, and then approves a different amount before the first transaction is mined, an attacker could front-run the second approval to spend the original approved amount, and then the second approval would overwrite the allowance, potentially allowing the attacker to spend more than intended. This is an inherent characteristic of the ERC20 standard and not a flaw in the OpenZeppelin implementation.

Fix

Inform users about this potential race condition. Recommend a 'set-to-zero then approve' pattern for changing allowances, where users first approve 0 and then the new amount. Alternatively, consider using ERC20 permit or a custom increaseAllowance/decreaseAllowance pattern if the token design allows for it, although OpenZeppelin's _spendAllowance mitigates some risks.

Status

Unresolved

Info

Use of unchecked Blocks for Addition

The _update function, specifically for _totalSupply += value and _balances[to] += value, utilizes unchecked blocks. In Solidity 0.8.0 and later, arithmetic operations revert on overflow/underflow by default. unchecked blocks disable this check. While this is a standard optimization in OpenZeppelin contracts, and uint256 provides a vast range, a theoretical overflow could occur if value is extremely large and the target variable is near type(uint256).max, leading to a wrap-around instead of a revert.I-01

Issue

The _update function, specifically for _totalSupply += value and _balances[to] += value, utilizes unchecked blocks. In Solidity 0.8.0 and later, arithmetic operations revert on overflow/underflow by default. unchecked blocks disable this check. While this is a standard optimization in OpenZeppelin contracts, and uint256 provides a vast range, a theoretical overflow could occur if value is extremely large and the target variable is near type(uint256).max, leading to a wrap-around instead of a revert.

Fix

No direct action is required as this is a standard and generally safe optimization in modern Solidity for operations where overflow is highly improbable. However, it's important to be aware of this design choice and ensure that the context of value in _mint and _burn operations does not introduce an unexpected overflow scenario.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The SQD token contract is an ERC20 implementation based on OpenZeppelin's battle-tested library, deployed on Arbitrum. It includes specific functions for bridging (bridgeMint, bridgeBurn) controlled by an immutable l2Gateway address. While the contract's technical implementation is robust and follows best practices, the centralized control over token supply by the l2Gateway introduces a significant external dependency risk, elevating the overall risk profile.

Technical8/10Low risk

The SQD token contract leverages the OpenZeppelin ERC20 standard, providing a robust and well-audited foundation (7.2 Code Security). Access control for bridge-specific minting and burning functions is correctly implemented using an onlyL2Gateway modifier, ensuring only the designated L2 gateway can modify the token supply (7.3 Access Control). The l2Gateway and l1Address are immutable, preventing unauthorized changes post-deployment (7.1 Architecture). A minor observation is the use of unchecked blocks for addition in _update, which is standard OpenZeppelin practice but theoretically could lead to overflow if uint256 limits are reached.

Governance1/10High risk

The economic security of the SQD token is heavily reliant on the l2Gateway contract, which possesses the exclusive ability to mint and burn tokens (7.4 Economic). This centralized control, while necessary for a bridged asset, represents a significant external dependency risk (7.6 External). A compromise of the l2Gateway would directly impact the token's supply integrity and value, leading to a critical economic impact on the entire protocol.

Upgrades6/10Medium risk

The SQD contract is not designed with an upgrade mechanism (e.g., proxy pattern), meaning its code is immutable after deployment (7.7 Upgrades). This eliminates risks associated with upgradeability, such as proxy misconfigurations or malicious upgrade paths. Any future changes or bug fixes would require a new deployment and a token migration process.

Final RecommendationWhat to do about this score

Prioritize the security and operational integrity of the l2Gateway contract, as it is the single point of control for the SQD token supply.

Implement robust monitoring, multi-signature controls, and a comprehensive incident response plan for the l2Gateway to detect and mitigate any unauthorized activity promptly. Educate users about the inherent risks of bridged assets and the reliance on the bridge's security.

Contract & Record

1 audit on record
TypeToken
NetworkArbitrum
Token age2y
Contract0x1337…8ab1
Deployer0x1de8…4add
Badge for your website
Subsquid security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 11, 202652Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Arbitrum DogMILES · Arbitrum53MediumSperax USDUSDS · Arbitrum51MediumCoW Protocol TokenCOW · Arbitrum54MediumAutonomiANT · Arbitrum49MediumEquilibria TokenEQB · Arbitrum55MediumWrapped BTCWBTC · Arbitrum57Medium

Would You Like a More Detailed Audit of Subsquid?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page