On-chain security analysis — is it a scam or legit?
EthereumThe TriaToken contract implements a standard ERC20 token with additional features for permit functionality and owner-controlled withdrawal of accidentally sent ETH or ERC20 tokens.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x0e09…c2190x8ba4…63b40x0b8a…9377No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
Withdrawable abstract contract, implemented by TriaToken, grants the contract owner (via onlyAuthorizer and _authorizeWithdraw()) sole authority to withdraw any ETH or ERC20 tokens accidentally sent to the TriaToken contract. While this is a common and often necessary pattern for recovering funds, it represents a centralized point of control for these specific operations. The security of these funds relies entirely on the integrity of the owner's address.L-01The Withdrawable abstract contract, implemented by TriaToken, grants the contract owner (via onlyAuthorizer and _authorizeWithdraw()) sole authority to withdraw any ETH or ERC20 tokens accidentally sent to the TriaToken contract. While this is a common and often necessary pattern for recovering funds, it represents a centralized point of control for these specific operations. The security of these funds relies entirely on the integrity of the owner's address.
Ensure the contract owner's address is a highly secure entity, such as a well-managed multisignature wallet, to mitigate the risks associated with centralized control. The prefill data indicates the owner is a multisig, which is a good practice.
Unresolved
TriaToken contract is not designed with upgradeability features (e.g., proxy pattern). This means that once deployed, its logic cannot be modified. Any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a potentially complex and costly migration process for token holders.I-01The TriaToken contract is not designed with upgradeability features (e.g., proxy pattern). This means that once deployed, its logic cannot be modified. Any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a potentially complex and costly migration process for token holders.
This is a design choice. If future flexibility or bug-fixing capabilities are desired, consider implementing an upgradeable proxy pattern (e.g., UUPS or Transparent Proxy) in future iterations. For this immutable contract, thorough testing is paramount before deployment.
Unresolved
TriaToken contract. This design choice fixes the token's maximum supply from deployment and prevents any future adjustments to the supply without redeploying the contract.I-02The initial total supply of 10,000,000,000 TRIA tokens (10 billion * 1e18) is hardcoded in the constructor of the TriaToken contract. This design choice fixes the token's maximum supply from deployment and prevents any future adjustments to the supply without redeploying the contract.
This is a deliberate design decision for a fixed-supply token. If future flexibility in token supply (e.g., dynamic minting/burning based on governance) is ever desired, it would require a new contract deployment. For the current design, no change is needed.
Unresolved
ERC20, ERC20Permit, Ownable, SafeERC20, and ReentrancyGuard. While these libraries are industry standards and have undergone extensive audits, any future vulnerabilities discovered within these external dependencies could potentially impact the security of the TriaToken contract.I-03The contract heavily relies on external, well-audited OpenZeppelin libraries, including ERC20, ERC20Permit, Ownable, SafeERC20, and ReentrancyGuard. While these libraries are industry standards and have undergone extensive audits, any future vulnerabilities discovered within these external dependencies could potentially impact the security of the TriaToken contract.
Regularly monitor security announcements and updates from OpenZeppelin. While direct action on the deployed contract is not possible, staying informed is crucial for understanding potential ecosystem-wide risks.
Unresolved
The TriaToken contract implements a standard ERC20 token with additional features for permit functionality and owner-controlled withdrawal of accidentally sent ETH or ERC20 tokens. The contract utilizes well-audited OpenZeppelin libraries and incorporates reentrancy protection for withdrawal functions. While the design is robust, some aspects like centralized withdrawal control and immutability are noted as design considerations.
The technical architecture (7.1 Architecture) is sound, leveraging standard ERC20, ERC20Permit, and Ownable patterns. Code security (7.2 Code Security) is enhanced by the use of OpenZeppelin's SafeERC20 for token transfers and ReentrancyGuard for withdrawal functions, preventing common attack vectors. Access control (7.3 Access Control) for withdrawals is centralized to the contract owner, which is a multisig, mitigating single-point-of-failure risks. External dependencies (7.6 External) are limited to battle-tested OpenZeppelin contracts.
The economic model (7.4 Economic) is straightforward with a fixed initial supply of 10 billion tokens, minted to a specified treasury address. Governance (7.5 Governance) is managed through an Ownable pattern, where the owner is a multisig, enhancing security and decentralization of control over critical functions like fund withdrawals. There are no complex tokenomics or fee structures, simplifying economic analysis.
The contract is not designed as an upgradeable proxy (7.7 Upgrades), meaning its logic is immutable once deployed. This eliminates upgrade-related risks such as proxy storage collisions or logic errors during upgrades. However, it also means that any future bug fixes or feature enhancements would require a new deployment and token migration.
The TriaToken contract demonstrates a robust implementation of an ERC20 token with secure withdrawal mechanisms.
We recommend ensuring the treasury address used in the constructor is a secure, preferably multisig, wallet to protect the initial token supply. Additionally, maintain vigilance regarding the security of the owner's multisig wallet, as it holds significant control over the contract's withdrawal functions.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
