Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Subsquid Safe?

SQDBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical5/10Governance1/10Upgrades2/10Checks passed2 of 5Findings1 Critical · 1 High · 1 Low · 1 Info4
SummaryAI Copilot

The PeerToken contract is an ERC-20 token with minting and burning capabilities, leveraging OpenZeppelin's audited libraries.

Read the full analysis
What raised the score
  • Ownership not renounced — owner is an EOA
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50% (94.5% total → 69.0% effective; 52.0% in EOAs, 42.5% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
42.5%Contracts52.0%Wallets5.5%
42.5%Contracts52.0%Wallets5.5%
ContractsWalletsEveryone elseBubble area = share of supply
94.5%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking42.5%
  • Walletsanonymous holders, free to sell52.0%
  • Everyone elsethe rest of the supply5.5%
Effective concentrationwhat the score reads69.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$419.3K across 5 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$416.0KShare of depth99.2%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x80db…09e3

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 High1 Low1 Info
Critical

Centralized Minting Authority and Unlimited Supply

The minter role, which is controlled by the owner, has the ability to mint an arbitrary amount of tokens without any on-chain supply cap. This poses a critical economic risk (7.4 Economic), as a compromised minter or owner key could lead to hyperinflation and severe devaluation of the token. The contract does not enforce any maximum total supply.C-01

Issue

The minter role, which is controlled by the owner, has the ability to mint an arbitrary amount of tokens without any on-chain supply cap. This poses a critical economic risk (7.4 Economic), as a compromised minter or owner key could lead to hyperinflation and severe devaluation of the token. The contract does not enforce any maximum total supply.

Fix

Implement a multi-signature wallet for the minter role. Consider adding a hard cap on the total supply of tokens or implementing a controlled minting schedule to limit the potential for inflation. If unlimited minting is a core design choice, ensure robust operational security for the minter and owner keys.

Status

Unresolved

High

High Centralization of Administrative Control

The Ownable pattern grants significant administrative power to a single owner address, specifically the ability to setMinter and transferOwnership (7.3 Access Control). This central point of failure increases operational risk (7.8 Operations), as a compromised owner key could lead to unauthorized changes in the minter role, loss of administrative control, or other malicious actions.H-01

Issue

The Ownable pattern grants significant administrative power to a single owner address, specifically the ability to setMinter and transferOwnership (7.3 Access Control). This central point of failure increases operational risk (7.8 Operations), as a compromised owner key could lead to unauthorized changes in the minter role, loss of administrative control, or other malicious actions.

Fix

Implement a multi-signature wallet for the owner address to distribute control and reduce the risk associated with a single point of failure. This would require multiple approvals for critical administrative actions, enhancing security.

Status

Unresolved

Low

Immutability of Contract Logic

The PeerToken contract is not upgradeable (7.7 Upgrades). While this eliminates risks associated with upgrade mechanisms, it means that any discovered vulnerabilities or desired feature changes would necessitate a new contract deployment and a potentially complex and costly migration of assets and user base. This lack of flexibility can be a long-term operational challenge.L-01

Issue

The PeerToken contract is not upgradeable (7.7 Upgrades). While this eliminates risks associated with upgrade mechanisms, it means that any discovered vulnerabilities or desired feature changes would necessitate a new contract deployment and a potentially complex and costly migration of assets and user base. This lack of flexibility can be a long-term operational challenge.

Fix

Acknowledge the implications of immutability. For future projects, if flexibility for bug fixes or feature enhancements is critical, consider implementing an upgradeable proxy pattern (e.g., UUPS) to allow for future contract logic updates without redeployment.

Status

Unresolved

Info

Single Address for Minter Role

The minter role is assigned to a single external address. While this is functional, for systems requiring higher security or distributed control, relying on a single address for such a powerful role can be a point of concern (7.3 Access Control, 7.8 Operations).I-01

Issue

The minter role is assigned to a single external address. While this is functional, for systems requiring higher security or distributed control, relying on a single address for such a powerful role can be a point of concern (7.3 Access Control, 7.8 Operations).

Fix

Consider using a multi-signature wallet or a more robust role-based access control (RBAC) system (e.g., OpenZeppelin's AccessControl contract) for the minter role to enhance security and decentralize control, if appropriate for the project's long-term vision.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The PeerToken contract is an ERC-20 token with minting and burning capabilities, leveraging OpenZeppelin's audited libraries. The primary risks identified stem from the highly centralized control over token supply and administrative functions, particularly the unlimited minting power held by a single minter address, which is itself controlled by a single owner address. While the code quality is high due to OpenZeppelin's robust implementations, the economic model introduces significant centralization risks.

Technical5/10Medium risk

The contract is well-structured, inheriting from standard OpenZeppelin ERC20, ERC20Burnable, and Ownable contracts (7.1 Architecture). It correctly implements access control modifiers (onlyMinter, onlyOwner) and includes zero-address checks for critical roles (e.g., setMinter) (7.3 Access Control). The use of unchecked blocks in _update is standard for OpenZeppelin's ERC20 and is protected by prior checks, preventing integer overflows/underflows (7.2 Code Security).

Governance1/10High risk

The economic model presents a critical risk due to the centralized minting authority. A single minter address, controlled by the owner, can mint an unlimited supply of tokens, posing a significant inflation risk (7.4 Economic). Furthermore, the owner holds substantial administrative power, including the ability to change the minter and transfer ownership, creating a single point of failure (7.3 Access Control, 7.8 Operations). There is no on-chain governance mechanism (7.5 Governance).

Upgrades2/10High risk

The PeerToken contract is implemented as a standard, non-upgradeable contract. This design choice eliminates risks associated with proxy patterns or upgrade mechanisms, such as storage collisions or faulty upgrade logic. However, it also means that any future bug fixes or feature enhancements would require a complete redeployment and migration of assets, which can be a complex and costly process (7.7 Upgrades).

Final RecommendationWhat to do about this score

To mitigate the identified risks, consider implementing a multi-signature wallet for both the owner and minter roles to distribute control and reduce the risk of a single point of failure.

Evaluate the necessity of unlimited minting; if a fixed supply or a capped minting schedule is desired, implement these restrictions directly within the contract logic. For future projects, assess the trade-offs between immutability and upgradeability, potentially using a proxy pattern if flexibility for bug fixes or feature enhancements is critical.

Contract & Record

1 audit on record
TypePeerToken
NetworkBNB Chain
Token age1y
Contract0xe50e…cc13
Deployer0x479b…d3c6
Badge for your website
Subsquid security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202672High
  2. Aug 11, 202660Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
PancakeSwap TokenCAKE · BNB Chain72HighBOBBNB Chain72HighNIGHTBNB Chain72HighWolfSafePoorPeopleWSPP · BNB Chain72HighAnomaXAN · BNB Chain71HighelizaOSBNB Chain73High

Would You Like a More Detailed Audit of Subsquid?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page