Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is The Stonks Exchange a Scam?

STONKEXBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on recordNew Launch · 5d old
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance2/10Upgrades6/10Checks passed5 of 7Findings1 Medium · 1 Low · 1 Info3
SummaryAI Copilot

The StonkToken contract is an ERC-20 token implementation, inheriting from OpenZeppelin's battle-tested ERC20 standard.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 20%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 98.5%
  • LP top3 unlocked holders = 99.8%
  • Token age < 7 days
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 20% (29.6% total → 20.0% effective; 13.6% in EOAs, 16.0% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 98.5% (independent LP — depth risk, pool = 70% of DEX liquidity)
  • LP top3 unlocked holders = 99.8% (independent LP — depth risk, pool = 70% of DEX liquidity)
  • Token age < 7 days (early, volatile)
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (5d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 45 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
16.0%Contracts13.6%Wallets70.4%Everyone else
16.0%13.6%70.4%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
29.6%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking16.0%
  • Walletsanonymous holders, free to sell13.6%
  • Everyone elsethe rest of the supply70.4%
Effective concentrationwhat the score reads20.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$272.2K across 11 pairs
Show 4 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$191.7KShare of depth70.4%
Top-1 Unlocked Holder98.5%
Top-3 Unlocked99.8%
Unlocked LP held by
0x71d1…0a7f0x641f…70400x6932…1f9f0x73e3…93d50xb270…9f6f0x2615…a0b40x5a3e…79e30x2992…2ffd0x5810…8eaf0x0020…ff6e

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Medium1 Low1 Info
Medium

External Dependency Risk in tokenURI Function

The tokenURI() function makes an external call to IStonkLauncherBaseURI(launcher).baseTokenURI(). While a try/catch block is used to handle reverts, a compromised or malicious launcher contract could return a baseTokenURI that points to a phishing site, misleading information, or content that misrepresents the StonkToken. This external dependency (7.6) introduces a risk to users who rely on the token's metadata for display or interaction.M-01

Issue

The tokenURI() function makes an external call to IStonkLauncherBaseURI(launcher).baseTokenURI(). While a try/catch block is used to handle reverts, a compromised or malicious launcher contract could return a baseTokenURI that points to a phishing site, misleading information, or content that misrepresents the StonkToken. This external dependency (7.6) introduces a risk to users who rely on the token's metadata for display or interaction.

Fix

Ensure the launcher address is controlled by a highly secure multi-signature wallet or a robust governance mechanism. Implement strict controls and auditing procedures for the launcher contract, especially for its baseTokenURI() function, to prevent it from returning malicious or misleading data. Consider adding a mechanism to update or disable the launcher address if it becomes compromised.

Status

Unresolved

Low

Unconventional Use of tokenURI for ERC-20

The tokenURI() function is typically associated with ERC-721 or ERC-1155 NFTs, where it provides metadata for a specific tokenId. In this ERC-20 contract, tokenURI() returns metadata based on the contract's own address, not a token ID. While not a direct security vulnerability, this architectural choice (7.1) is unconventional for an ERC-20 and may lead to confusion or misinterpretation by platforms and users expecting ERC-721/1155 behavior or standard ERC-20 metadata practices.L-01

Issue

The tokenURI() function is typically associated with ERC-721 or ERC-1155 NFTs, where it provides metadata for a specific tokenId. In this ERC-20 contract, tokenURI() returns metadata based on the contract's own address, not a token ID. While not a direct security vulnerability, this architectural choice (7.1) is unconventional for an ERC-20 and may lead to confusion or misinterpretation by platforms and users expecting ERC-721/1155 behavior or standard ERC-20 metadata practices.

Fix

Clearly document the intended purpose and usage of the tokenURI() function for the StonkToken. If the goal is general token metadata, consider if a different approach (e.g., off-chain metadata linked to the contract address) would be less ambiguous. If it's intended for specific platform integration, ensure that platform understands this unique implementation.

Status

Unresolved

Info

Centralization of Initial Token Supply

During contract deployment, the entire totalSupply_ is minted to the launcher_ address. This design choice (7.4) means that the launcher address holds 100% of the initial token supply. While this is a valid design pattern, it implies significant control by the launcher over the token's initial distribution and market dynamics. Any compromise of the launcher address could lead to a large-scale token dump.I-01

Issue

During contract deployment, the entire totalSupply_ is minted to the launcher_ address. This design choice (7.4) means that the launcher address holds 100% of the initial token supply. While this is a valid design pattern, it implies significant control by the launcher over the token's initial distribution and market dynamics. Any compromise of the launcher address could lead to a large-scale token dump.

Fix

Ensure the launcher address is secured with robust measures, such as a hardware wallet or a multi-signature setup. If the intention is to distribute tokens, a clear and transparent distribution plan should be communicated to the community. Consider implementing time-locks or vesting schedules for large token holdings if appropriate for the project's tokenomics.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The StonkToken contract is an ERC-20 token implementation, inheriting from OpenZeppelin's battle-tested ERC20 standard. The contract's primary custom logic involves a tokenURI() function that queries an external launcher contract for a base URI. The audit identified a medium-severity risk related to this external dependency, a low-severity architectural quirk, and an informational finding regarding initial token distribution. The core ERC-20 functionality is robust due to OpenZeppelin inheritance.

Technical8/10Low risk

The StonkToken contract demonstrates good technical architecture (7.1) by inheriting from OpenZeppelin's ERC20, which provides a robust and audited foundation for token functionality. The custom _hexAddress() function is correctly implemented for its purpose. However, the tokenURI() function introduces an external dependency (7.6) on the launcher address, which could potentially serve malicious metadata if compromised. While try/catch is used for error handling, it does not mitigate the risk of malicious but valid data.

Governance2/10High risk

The economic model (7.4) of StonkToken is straightforward: a fixed total supply is minted entirely to the launcher address during deployment. This design choice centralizes initial token distribution to a single entity. There are no explicit governance mechanisms (7.5) or privileged roles beyond the initial constructor parameters, simplifying the contract's operational footprint (7.8).

Upgrades6/10Medium risk

The StonkToken contract is not designed with upgradeability in mind (7.7). It is a standard, non-proxy implementation, meaning its logic cannot be altered post-deployment. This reduces complexity and eliminates upgrade-related risks, but also means any discovered vulnerabilities would require a new deployment.

Final RecommendationWhat to do about this score

It is recommended to carefully manage the launcher address, as its associated contract controls the baseTokenURI which influences how the token's metadata is presented.

Ensure the launcher contract is secure and its baseTokenURI function is robust against manipulation. Additionally, consider documenting the intended use of the tokenURI() function for an ERC-20 token to clarify its purpose for users and integrators.

Contract & Record

1 audit on record
TypeStonkToken
NetworkBase
Token age5d
Contract0x5ab0…80f5
Deployer0x81dd…e1e1
Badge for your website
The Stonks Exchange security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202636Medium
  2. Aug 30, 202637Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
PlayBase36MediumBasehatBase36MediumOpalBase36Mediumaixbt by VirtualsAIXBT · Base36MediumAn Amazon BoxBOX · Base36MediumOpenGradientOPG · Base37Medium

Would You Like a More Detailed Audit of The Stonks Exchange?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page