Early-stage security check — honeypot & rug-pull analysis

Is Umia a Scam?

UMIABase

Not verified

This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →

Last checked Sep 4, 2026 · 1 audit on recordNew Launch · 21h old

Chart

63/ 100

Medium RiskHow is this score calculated?

How the score breaks downratings: 10 is safest

Technical7/10 Governance2/10 Upgrades4/10 Checks passed4 of 7 Findings1 High · 1 Medium · 2 Info4

SummaryAI Copilot

The VentureToken contract is an ERC-20 compliant token with pausable and ownable functionalities, built upon battle-tested OpenZeppelin libraries.

Read the full analysis

What raised the score

Ownership not renounced — owner is a contract
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 20%
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 62.9%
LP top3 unlocked holders = 91.2%
Token age < 24h
1 High finding(s) from audit
1 Medium finding(s) from audit

Exact factors

Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 20% (64.0% total → 29.7% effective; 6.9% in EOAs, 57.1% in contracts — mild)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 62.9% (independent LP — depth risk, pool = 97% of DEX liquidity)
LP top3 unlocked holders = 91.2% (independent LP — depth risk, pool = 97% of DEX liquidity)
Token age < 24h (brand new — bot activity, unproven)
1 High finding(s) from audit
1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (21h old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 44 of 7 checks passed

Contract verifiedVerified

OwnershipRetained

MintMintable

Liquidity lockNot locked

UpgradeabilityFixed code

HoneypotNone found

Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026

ContractsWalletsEveryone elseBubble area = share of supply

64.0%of supply sits with the top 10 holders

Contractstreasury, vesting, bridge, staking57.1%
Walletsanonymous holders, free to sell6.9%
Everyone elsethe rest of the supply36.0%

Effective concentrationwhat the score reads29.7%

How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$3.17M across 12 pairs

Show 4 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$3.06MShare of depth96.6%

Top-1 Unlocked Holder62.9%

Top-3 Unlocked91.2%

Unlocked LP held by

0x575e…fe980x4dd2…29560x73e3…93d50xe33c…b16d0x8df3…c1020x2992…2ffd0x670e…2dfe0x189d…1e630xff4a…3f450xd7a4…3bfb

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High1 Medium2 Info

High

Centralized Control by Owner

The owner address has exclusive control over several critical functions, including mint(address to, uint256 amount), burn(address from, uint256 amount), pause(), unpause(), and transferOwnership(address newOwner). This grants the owner the ability to arbitrarily increase or decrease the token supply, halt all token transfers, and transfer this extensive control to any other address. A compromise of the owner's private key or malicious intent by the owner could lead to severe economic manipulation or a complete denial of service for token holders (7.3 Access Control, 7.4 Economic, 7.5 Governance).H-01

Issue

Fix

Implement a multi-signature wallet (e.g., Gnosis Safe) for the owner address to require multiple approvals for critical operations. Alternatively, consider integrating a decentralized governance mechanism to distribute control over these sensitive functions among token holders or a council. Clearly document the owner's capabilities and the security measures in place for the owner's address.

Status

Unresolved

Medium

Pausability as a Denial of Service Vector

The pause() function, callable only by the owner, can halt all token transfers (excluding minting and burning, as per the custom _update logic). While intended for emergency situations, this functionality allows the owner to unilaterally freeze user funds and prevent any token movement. This represents a significant denial of service risk for token holders if the owner acts maliciously or is compromised (7.3 Access Control, 7.8 Operations).M-01

Issue

Fix

Define clear criteria and a transparent process for when the pause() function can be invoked. Consider implementing a time-locked pause or a multi-signature requirement for pausing to introduce a delay or additional checks before activation. Communicate the purpose and implications of pausability to users.

Status

Unresolved

Info

Minting and Burning Unaffected by Pause State

The custom _update function in VentureToken includes a condition `if (paused() && from != address(0) && to != address(0)) revert EnforcedPause();`. This specific logic means that while regular transfers are paused, operations involving address(0) (i.e., _mint where from is address(0) and _burn where to is address(0)) are not affected by the paused() state. The owner can still mint and burn tokens even when the token is paused (7.1 Architecture, 7.2 Code Security).I-01

Issue

Fix

This is a deliberate design choice. Ensure this behavior is clearly documented and understood by all stakeholders. If the intention was for minting and burning to also be paused, the _update logic would need to be adjusted to remove the from != address(0) && to != address(0) conditions from the pause check.

Status

Unresolved

Info

Reliance on OpenZeppelin Libraries

The VentureToken contract extensively utilizes well-audited and widely adopted OpenZeppelin contracts (ERC20, ERC20Pausable, Ownable, ERC165). This practice significantly enhances the security posture of the contract by building upon battle-tested and community-vetted codebases, reducing the surface area for novel vulnerabilities (7.1 Architecture, 7.2 Code Security).I-02

Issue

Fix

Continue to monitor OpenZeppelin's security advisories and updates. Ensure that the specific versions of OpenZeppelin contracts used are compatible and do not contain known vulnerabilities. Regularly review dependencies for any security patches.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4

Executive SummaryWhat the contract is and what the review found

The VentureToken contract is an ERC-20 compliant token with pausable and ownable functionalities, built upon battle-tested OpenZeppelin libraries. The primary risks identified are related to the high degree of centralization of power vested in the contract owner, who can mint, burn, pause transfers, and transfer ownership. While the code quality is high due to OpenZeppelin's robust implementation, the extensive owner privileges introduce significant governance and economic risks.

Technical7/10Low risk

The VentureToken contract demonstrates strong technical foundations by inheriting from well-audited OpenZeppelin contracts (ERC20, ERC20Pausable, Ownable, ERC165). This significantly reduces the likelihood of common coding vulnerabilities (7.2 Code Security). The contract correctly implements the ERC-20 standard and custom interfaces (7.1 Architecture). However, the _update override in VentureToken deviates from standard ERC20Pausable behavior, allowing minting and burning even when the token is paused, which is a specific design choice (7.2 Code Security).

Governance2/10High risk

The contract exhibits a high degree of centralization, with the owner address possessing extensive control over critical functions (7.3 Access Control). The owner can mint new tokens, burn existing tokens, pause all token transfers, and transferOwnership to any address (7.4 Economic). This concentration of power means that a compromise of the owner's private key or malicious action by the owner could lead to severe economic consequences, including inflation, deflation, or a complete halt of token utility (7.5 Governance).

Upgrades4/10Medium risk

The VentureToken contract is implemented as a standard, non-upgradeable contract. There are no proxy patterns or upgrade mechanisms in place (7.7 Upgrades). This eliminates upgrade-related risks such as proxy initialization errors, storage collisions, or logic inconsistencies between implementation versions. The contract's logic is immutable once deployed.

Final RecommendationWhat to do about this score

It is strongly recommended to secure the owner address with a robust multi-signature wallet or a well-tested governance mechanism to mitigate the significant centralization risks.

Implement clear communication channels to inform users about the owner's capabilities, especially regarding pausing and token supply adjustments. Consider a phased approach to decentralization if the project aims for greater community control in the future.

Contract & Record

1 audit on record

TypeVentureToken

NetworkBase

Token age21h

Contract0x56ab…ba7d

Deployer0x81a1…5fde

Badge for your website

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History

Sep 4, 202663Medium
Sep 3, 202643Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the UMIA contract address?

The Umia contract on Base is 0x56ab53b77f07da3af732150e8aec4783eb5bba7d. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.