Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is UNICURVE Safe?

Ethereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades1/10Checks passed2 of 5Findings2 High · 1 Medium · 1 Low · 2 Info6
SummaryAI Copilot

The UnicurveToken contract is an ERC20 token designed for an EIP-1167 cloning pattern.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Proxy contract
  • Non-standard proxy storage
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Proxy contract (upgradeable — admin can replace logic)
  • Non-standard proxy storage (Etherscan-confirmed)
  • Top-10 concentration > 30% (61.8% total → 39.1% effective; 23.9% in EOAs, 37.9% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 82% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 82% of DEX liquidity)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
37.9%Contracts23.9%Wallets38.2%Everyone else
37.9%Contracts23.9%Wallets38.2%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
61.8%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking37.9%
  • Walletsanonymous holders, free to sell23.9%
  • Everyone elsethe rest of the supply38.2%
Effective concentrationwhat the score reads39.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$62.9K across 5 pairs
  • Analysed pair$51.6K82.0%

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$51.6KShare of depth82.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x1ac4…062c0x632b…189a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 High1 Medium1 Low2 Info
High

Centralized Control by curve Address

The curve address, set during initialization, is the sole recipient of the entire token supply (1 billion tokens) and the only entity capable of calling enableTransfers(). This grants the curve address complete control over token distribution and transferability, representing a single point of failure (7.3 Access Control, 7.5 Governance).H-01

Issue

The curve address, set during initialization, is the sole recipient of the entire token supply (1 billion tokens) and the only entity capable of calling enableTransfers(). This grants the curve address complete control over token distribution and transferability, representing a single point of failure (7.3 Access Control, 7.5 Governance).

Fix

Acknowledge and clearly communicate this high degree of centralization to all users and potential investors. If future decentralization is desired, consider implementing a multi-signature wallet or a time-locked contract for the curve address to manage critical functions.

Status

Unresolved

High

Potential for Rug Pull / Malicious curve Behavior

With 100% of the token supply minted to the curve address and its exclusive control over enabling transfers, there is a significant risk of a 'rug pull' (7.4 Economic). If the curve address is controlled by a malicious actor, they could unilaterally dump all tokens onto the market, causing a severe price crash.H-02

Issue

With 100% of the token supply minted to the curve address and its exclusive control over enabling transfers, there is a significant risk of a 'rug pull' (7.4 Economic). If the curve address is controlled by a malicious actor, they could unilaterally dump all tokens onto the market, causing a severe price crash.

Fix

Transparency is crucial. Clearly communicate the token distribution model and the power of the curve address to potential investors. Implement mechanisms (e.g., liquidity locks, vesting schedules for the curve address's holdings) in the curve contract itself to build trust, if applicable to the project's design.

Status

Unresolved

Medium

Permanent Transfer Lock Risk

The enableTransfers() function, which sets transfersEnabled = true, can only be called by the curve address. If the curve address is compromised, lost, or becomes inaccessible, the tokens could remain permanently untransferable (except for transfers involving the curve itself), leading to a denial of service for token holders (7.3 Access Control, 7.8 Operations).M-01

Issue

The enableTransfers() function, which sets transfersEnabled = true, can only be called by the curve address. If the curve address is compromised, lost, or becomes inaccessible, the tokens could remain permanently untransferable (except for transfers involving the curve itself), leading to a denial of service for token holders (7.3 Access Control, 7.8 Operations).

Fix

Ensure robust security and operational procedures for the curve address. Consider a mechanism to transfer curve ownership or a time-locked release of transfer control if the original curve becomes unresponsive, though this adds complexity and new risks.

Status

Unresolved

Low

EIP-1167 Clone Initialization Race Condition (Theoretical)

The initialize function lacks explicit access control beyond the AlreadyInitialized check. In an EIP-1167 factory deployment scenario, if the factory's deployment and initialization logic is not atomic or properly secured, a malicious actor could theoretically front-run the initialize call on a newly deployed clone, setting an attacker-controlled curve address (7.2 Code Security, 7.3 Access Control).L-01

Issue

The initialize function lacks explicit access control beyond the AlreadyInitialized check. In an EIP-1167 factory deployment scenario, if the factory's deployment and initialization logic is not atomic or properly secured, a malicious actor could theoretically front-run the initialize call on a newly deployed clone, setting an attacker-controlled curve address (7.2 Code Security, 7.3 Access Control).

Fix

Ensure the factory contract responsible for deploying and initializing UnicurveToken clones implements robust access control (e.g., onlyFactory or onlyOwner for initialization calls) and/or atomic deployment-initialization patterns to prevent front-running.

Status

Unresolved

Info

Missing Event for enableTransfers

The enableTransfers() function modifies a critical state variable (transfersEnabled) but does not emit an event. Emitting an event would improve transparency and allow off-chain monitoring of this crucial state change (7.2 Code Security, 7.8 Operations).I-01

Issue

The enableTransfers() function modifies a critical state variable (transfersEnabled) but does not emit an event. Emitting an event would improve transparency and allow off-chain monitoring of this crucial state change (7.2 Code Security, 7.8 Operations).

Fix

Emit an event (e.g., event TransfersEnabled(address indexed caller, uint256 timestamp);) when transfersEnabled is set to true to provide better traceability and off-chain monitoring capabilities.

Status

Unresolved

Info

Hardcoded SUPPLY Constant

The SUPPLY variable is declared as a public constant, fixing the total token supply at 1,000,000,000e18. This design choice means the token's total supply cannot be altered in the future without deploying a new contract (7.1 Architecture, 7.4 Economic).I-02

Issue

The SUPPLY variable is declared as a public constant, fixing the total token supply at 1,000,000,000e18. This design choice means the token's total supply cannot be altered in the future without deploying a new contract (7.1 Architecture, 7.4 Economic).

Fix

This is a design decision for a fixed-supply token. No action is required if this immutability is intended. If flexibility in total supply was ever desired, a different token architecture (e.g., mintable/burnable) would be necessary.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The UnicurveToken contract is an ERC20 token designed for an EIP-1167 cloning pattern. It features a highly centralized control model where a designated 'curve' address receives the entire token supply and controls the ability to enable/disable transfers. While the code is simple and leverages OpenZeppelin's battle-tested ERC20 implementation, the extreme centralization introduces significant economic and operational risks, including potential for a rug pull and permanent transfer lock.

Technical6/10Medium risk

The contract leverages battle-tested OpenZeppelin ERC20 for core token functionality, enhancing code security (7.2 Code Security). The logic is straightforward, primarily managing a transfersEnabled flag and a curve address. However, the curve address holds significant technical control, including the ability to enable/disable all transfers (7.3 Access Control), representing a single point of failure.

Governance1/10High risk

The economic model is highly centralized, with the entire token supply minted to the curve address upon initialization (7.4 Economic). This grants the curve address complete control over token distribution and market dynamics, posing a high risk of a 'rug pull' if misused (7.4 Economic). There is no on-chain governance, concentrating all decision-making power with the curve controller (7.5 Governance).

Upgrades1/10High risk

The UnicurveToken contract is designed as an EIP-1167 clone, meaning it is not directly upgradeable (7.7 Upgrades). This eliminates risks associated with upgrade mechanisms, such as proxy misconfigurations or logic bugs introduced during upgrades. Any future changes to token logic would require deploying a new token contract.

Final RecommendationWhat to do about this score

Given the highly centralized nature of the UnicurveToken, it is paramount to ensure the security and trustworthiness of the curve address.

Implement robust key management practices for this address, potentially utilizing a multi-signature wallet or a time-locked contract for critical operations like enabling transfers or managing the initial token supply. Transparency with the community regarding the token's distribution and control mechanisms is also crucial to manage expectations and build trust.

Contract & Record

1 audit on record
TypeUnicurveToken
NetworkEthereum
Token age3mo
Contract0xd400…c0de
Deployer0xf942…1458
Proxy Upgrade Controls
Proxy TypeEtherscan Detected Custom
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
UNICURVE security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202668High
  2. Aug 1, 202672High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the UNICURVE contract address?

The UNICURVE contract on Ethereum is 0xd400a048b726eba969449b342dc7c0e74187c0de. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is UNICURVE a scam?

Quantum Audit's risk score for UNICURVE is 68/100 (High risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is UNICURVE liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $62.9K.

Who holds UNICURVE?

As of Sep 4, 2026, the 10 largest holders own 61.8% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
REEthereum68HighZamaEthereum68HighChainXCN · Ethereum68HighPhalaPHA · Ethereum68HighGram (prev. Toncoin)GRAM · Ethereum69HighDIATokenDIA · Ethereum67High

Would You Like a More Detailed Audit of UNICURVE?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page