Quantum Audit Logo

Is trUSD Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

trUSD TRUSD
0xd058…1697
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

The TrUSD contract implements an upgradeable ERC-20 token with a two-tiered access control system. While leveraging battle-tested OpenZeppelin libraries and a multisig for the primary admin role, a significant risk arises from the immediate execution capabilities of the TIMELOCK_ADMIN_ROLE for critical functions like token minting and contract upgrades, lacking the timelock present for the DEFAULT_ADMIN_ROLE. This centralization of immediate power, if compromised, could lead to severe economic or operational consequences.

1 High1 Medium1 Low
Volume 24h
$900.3K
Liquidity
$5.16M
Price
$1.0000
Token Age
26d
Top 10 Holders
99.7%

Security Findings

1 High1 Med1 Low
High

Immediate and Centralized Control over Critical Functions (Minting & Upgrades)

H-01The `TIMELOCK_ADMIN_ROLE` has immediate and centralized control over critical functions: `setMinter` (allowing unlimited token minting) and `_authorizeUpgrade` (allowing instant contract upgrades). Unlike the `DEFAULT_ADMIN_ROLE`, which has a 1-day timelock, actions by the `TIMELOCK_ADMIN_ROLE` can be executed instantly. This concentration of power, coupled with the lack of a timelock for these actions, presents a significant risk of immediate economic manipulation or malicious contract changes if the `TIMELOCK_ADMIN_ROLE` is compromised or misused. (7.3 Access Control, 7.4 Economic, 7.7 Upgrades)
IssueThe `TIMELOCK_ADMIN_ROLE` has immediate and centralized control over critical functions: `setMinter` (allowing unlimited token minting) and `_authorizeUpgrade` (allowing instant contract upgrades). Unlike the `DEFAULT_ADMIN_ROLE`, which has a 1-day timelock, actions by the `TIMELOCK_ADMIN_ROLE` can be executed instantly. This concentration of power, coupled with the lack of a timelock for these actions, presents a significant risk of immediate economic manipulation or malicious contract changes if the `TIMELOCK_ADMIN_ROLE` is compromised or misused. (7.3 Access Control, 7.4 Economic, 7.7 Upgrades)
FixImplement a timelock mechanism for all critical actions performed by the `TIMELOCK_ADMIN_ROLE`, specifically for `setMinter` and `_authorizeUpgrade`. This would introduce a delay, allowing for community review and intervention. Additionally, ensure the `TIMELOCK_ADMIN_ROLE` itself is controlled by a robust, multi-signature wallet with a high threshold to mitigate the centralization risk.
StatusUnresolved
Medium

TIMELOCK_ADMIN_ROLE Transfer Mechanism Vulnerability

M-01The `setTimelockAdmin` function allows the current `TIMELOCK_ADMIN_ROLE` to transfer its role to a new address. If the `TIMELOCK_ADMIN_ROLE` is controlled by a single EOA or a low-threshold multisig, a compromise of this entity could lead to an unauthorized transfer of the role, potentially bypassing the `DEFAULT_ADMIN_ROLE`'s timelock for subsequent actions. (7.3 Access Control, 7.8 Operations)
IssueThe `setTimelockAdmin` function allows the current `TIMELOCK_ADMIN_ROLE` to transfer its role to a new address. If the `TIMELOCK_ADMIN_ROLE` is controlled by a single EOA or a low-threshold multisig, a compromise of this entity could lead to an unauthorized transfer of the role, potentially bypassing the `DEFAULT_ADMIN_ROLE`'s timelock for subsequent actions. (7.3 Access Control, 7.8 Operations)
FixEnsure the `TIMELOCK_ADMIN_ROLE` is managed by a highly secure, multi-signature wallet. Consider adding a timelock to the `setTimelockAdmin` function itself, or requiring approval from the `DEFAULT_ADMIN_ROLE` for such a critical transfer.
StatusUnresolved
Low

One-Time `initializeTimelockAdmin` Call Risk

L-01The `initializeTimelockAdmin` function can only be called once by the `DEFAULT_ADMIN_ROLE` to set the initial `TIMELOCK_ADMIN_ROLE`. If an incorrect or compromised address is set during this initial call, it would require the `DEFAULT_ADMIN_ROLE` to manually revoke and regrant the role, which is possible but adds operational complexity and potential for error. (7.8 Operations)
IssueThe `initializeTimelockAdmin` function can only be called once by the `DEFAULT_ADMIN_ROLE` to set the initial `TIMELOCK_ADMIN_ROLE`. If an incorrect or compromised address is set during this initial call, it would require the `DEFAULT_ADMIN_ROLE` to manually revoke and regrant the role, which is possible but adds operational complexity and potential for error. (7.8 Operations)
FixExercise extreme caution and verify the `timelockAdmin` address thoroughly before calling `initializeTimelockAdmin`. Implement robust pre-deployment checks and consider a multi-step initialization process or a mechanism for the `DEFAULT_ADMIN_ROLE` to correct the initial assignment more smoothly if needed.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The contract demonstrates good technical architecture (7.1) by utilizing OpenZeppelin's upgradeable ERC-20 and AccessControlDefaultAdminRules libraries, ensuring a solid foundation for code security (7.2). The implementation correctly handles initializers and prevents role renunciation. However, a key technical risk lies in the access control (7.3) for the TIMELOCK_ADMIN_ROLE, which can execute critical functions like `setMinter` and `_authorizeUpgrade` immediately, bypassing any timelock, which is a significant concern for upgrade safety (7.7).

GovernanceHigh3/10

The governance and economic model (7.5, 7.4) benefits from a two-tiered access control structure, where the DEFAULT_ADMIN_ROLE (assumed multisig with a 1-day timelock) controls the TIMELOCK_ADMIN_ROLE. This provides a layer of defense for the primary administrative functions. However, the TIMELOCK_ADMIN_ROLE itself has immediate power over token minting via `setMinter` and contract upgrades, posing a significant economic risk (7.4) due to potential for instant supply manipulation or malicious upgrades if this role is compromised. The `setTimelockAdmin` function also allows the TIMELOCK_ADMIN_ROLE to transfer itself without additional checks, which could be a governance vulnerability.

UpgradesHigh1/10

The contract correctly implements the UUPS upgradeability pattern (7.7) using OpenZeppelin's `UUPSUpgradeable` module, overriding `_authorizeUpgrade` to restrict upgrade authorization to the TIMELOCK_ADMIN_ROLE. This is a standard and secure approach. However, the absence of a timelock for the TIMELOCK_ADMIN_ROLE's upgrade authorization means that a compromised TIMELOCK_ADMIN_ROLE could instantly upgrade the contract to malicious logic, bypassing any delay for community review or intervention.

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeEip1967 Uups
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

99.7% in top 10
2.8% in wallets97.0% in contracts
Effective Concentration41.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$5.16M

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

2 addresses
Deployer
0xb5af…2b72
Unlocked LP Held By
0xfb16…f023

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

11 factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 30% (99.7% total → 41.6% effective; 2.8% in EOAs, 97.0% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • Token age < 30 days (still settling)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Main Street USD (MSUSD)Critical RiskSynapse (SYN)Critical RiskCovalent X Token (CXT)Critical RiskAutonolas (OLAS)Critical RiskChipCritical RiskUSDxCritical Risk

Would You Like a More Detailed Audit of trUSD?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit