Quantum Audit Logo

Is Supergemma4-26b-multimodal Safe?

On-chain security analysis — is it a scam or legit?

Supergemma4-26b-multimodal SUPERGEMMA
0x572c…aba3
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The DERC20 token contract implements an ERC20 token with voting, permit, and custom inflation and vesting mechanisms. It utilizes battle-tested OpenZeppelin libraries for core functionalities. The contract design centralizes significant control in the owner, particularly regarding token supply dynamics and a unique pool locking mechanism. While the code quality is generally good, the high degree of owner privilege introduces notable economic and operational risks.

1 High1 Medium1 Low1 Informational
Volume 24h
$9.5K
Liquidity
$170.5K
Price
$0.000004225
Token Age
3mo
Top 10 Holders
45.2%

Security Findings

1 High1 Med1 Low1 Info
High

Centralized Control over Pool Funds via `lockPool`

H-01The `lockPool` function allows the contract owner to designate a `pool` address and subsequently prevent any token transfers *from* that address by setting `isPoolUnlocked` to `false`. This mechanism is enforced in the `_beforeTokenTransfer` hook. This grants the owner the unilateral power to freeze tokens held by any contract designated as the `pool`, posing a significant centralization and economic risk (7.3, 7.4).
IssueThe `lockPool` function allows the contract owner to designate a `pool` address and subsequently prevent any token transfers *from* that address by setting `isPoolUnlocked` to `false`. This mechanism is enforced in the `_beforeTokenTransfer` hook. This grants the owner the unilateral power to freeze tokens held by any contract designated as the `pool`, posing a significant centralization and economic risk (7.3, 7.4).
FixRe-evaluate the necessity of the `lockPool` mechanism. If this functionality is critical, consider implementing a timelock, multi-signature approval, or a more decentralized governance mechanism for its activation. Clearly document this capability and its intended use to ensure transparency for users and integrators.
StatusUnresolved
Medium

Owner's Sole Control over Inflation and Burning

M-01The `mintInflation` function, while publicly callable, directs all newly minted tokens to the `owner()`. Additionally, the `burn` and `updateMintRate` functions are restricted to `onlyOwner`. This grants the owner significant, centralized control over the token's supply dynamics, including inflation and deflation, which could be exploited or lead to governance concerns (7.3, 7.4, 7.5).
IssueThe `mintInflation` function, while publicly callable, directs all newly minted tokens to the `owner()`. Additionally, the `burn` and `updateMintRate` functions are restricted to `onlyOwner`. This grants the owner significant, centralized control over the token's supply dynamics, including inflation and deflation, which could be exploited or lead to governance concerns (7.3, 7.4, 7.5).
FixFor core economic parameters like inflation and burning, consider transitioning to a more decentralized governance model (e.g., a DAO) or implementing a timelock for sensitive operations. This would provide transparency, introduce a delay for malicious actions, and reduce reliance on a single entity.
StatusUnresolved
Low

Missing `releaseVestedTokens` Function

L-01The contract includes a `VestingData` struct, a `getVestingDataOf` mapping, and several vesting-related error messages (`ReleaseAmountInvalid`, `VestingNotStartedYet`). However, the `releaseVestedTokens` function, which would allow users to claim their vested tokens, is not present in the provided source code snippet. This makes the vesting mechanism incomplete or unusable as presented (7.1).
IssueThe contract includes a `VestingData` struct, a `getVestingDataOf` mapping, and several vesting-related error messages (`ReleaseAmountInvalid`, `VestingNotStartedYet`). However, the `releaseVestedTokens` function, which would allow users to claim their vested tokens, is not present in the provided source code snippet. This makes the vesting mechanism incomplete or unusable as presented (7.1).
FixEnsure the complete vesting logic, including the `releaseVestedTokens` function, is implemented and available for users to claim their vested tokens. This function should correctly calculate and transfer available vested amounts based on `vestingStart`, `vestingDuration`, and `block.timestamp`.
StatusUnresolved
Info

BUSL-1.1 License Usage

I-01The contract uses the Business Source License 1.1 (BUSL-1.1). This is a non-open-source license that typically restricts usage for a certain period (e.g., 3-5 years) before converting to an open-source license like MIT. This licensing choice might have implications for project adoption, integration, and future development depending on the specific terms (7.6).
IssueThe contract uses the Business Source License 1.1 (BUSL-1.1). This is a non-open-source license that typically restricts usage for a certain period (e.g., 3-5 years) before converting to an open-source license like MIT. This licensing choice might have implications for project adoption, integration, and future development depending on the specific terms (7.6).
FixBe aware of the implications of BUSL-1.1. Ensure all stakeholders understand the licensing terms and their potential impact on the project's ecosystem, community engagement, and future development plans.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract leverages battle-tested OpenZeppelin libraries for ERC20, ERC20Votes, and ERC20Permit functionalities, enhancing code security (7.2). Custom logic for inflation and vesting appears mathematically sound, and error handling is robust. However, a significant technical risk lies in the `lockPool` mechanism (7.3), which allows the owner to prevent token transfers from a designated address, potentially freezing funds. The `mintInflation` function, while publicly callable, directs minted tokens to the owner, centralizing control over supply (7.3).

GovernanceMedium4/10

The contract exhibits a high degree of centralization, primarily due to the `Ownable` pattern (7.5). The owner has sole control over critical economic parameters such as the yearly mint rate, token burning, and the ability to lock/unlock the designated `pool` address (7.4). This `lockPool` functionality presents a substantial economic risk, as it grants the owner the power to unilaterally freeze tokens within a specific contract (7.4). While the inflation rate is capped at 2% (7.4), the owner's ability to control its application and the overall supply dynamics introduces a single point of failure.

UpgradesLow7/10

The contract is not designed as an upgradeable proxy (7.7), which simplifies its architecture and eliminates upgrade-related risks such as storage collisions or proxy implementation vulnerabilities. This provides a stable and immutable contract state. However, any future changes to the contract's logic would require a new deployment and migration of assets, which can be a complex and costly process.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

45.2% in top 10
11.9% in wallets33.3% in contracts
Effective Concentration25.3%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$170.6K across 2 pairs
Uniswap v4WETHanalysed$170.5K100.0%Uniswap v2WETH$170.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder88.7%
Top-3 Unlocked99.3%

Key Addresses

5 addresses
Deployer
0x57c5…5870
Unlocked LP Held By
0xe17c…11020x8ee4…485a0x170f…7cec0x1abe…00e2

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
  • Top-10 concentration > 20% (45.2% total → 25.3% effective; 11.9% in EOAs, 33.3% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 88.7% (independent LP — depth risk)
  • LP top3 unlocked holders = 99.3% (independent LP — depth risk)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Avantis (AVNT)High RiskCoinbase Wrapped Staked ETH (CBETH)High RiskThe Innovation Game (TIG)High RiskMetronome Synth ETH (MSETH)High RiskOpenUSDT (OUSDT)High RiskBasemateHigh Risk

Would You Like a More Detailed Audit of Supergemma4-26b-multimodal?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit