On-chain security analysis — is it a scam or legit?
BNB ChainThe UaiToken contract implements a standard ERC20 token with ERC20Permit functionality, leveraging battle-tested OpenZeppelin libraries.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x76b1…51ec0x578a…ca520x125a…f1c60xb69b…6097No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
recipient address during contract deployment. This makes the security of the entire token supply highly dependent on the security of this single address. A compromise of this address would lead to the loss of all tokens, representing a significant operational risk (7.8 Operations).L-01The entire token supply (1,000,000,000 UAI with 18 decimals) is minted to a single recipient address during contract deployment. This makes the security of the entire token supply highly dependent on the security of this single address. A compromise of this address would lead to the loss of all tokens, representing a significant operational risk (7.8 Operations).
The recipient address should be a highly secured multi-signature wallet or a cold storage address. Consider distributing the initial supply across multiple secure addresses or a vesting contract to reduce single points of failure and enhance overall security posture.
Unresolved
pause function or an onlyOwner modifier for critical operations. While this promotes decentralization and immutability, it means there is no way to halt transfers or other token operations in the event of a critical vulnerability or exploit in an integrated DeFi protocol (7.3 Access Control, 7.8 Operations).L-02The UaiToken contract does not include any emergency control mechanisms such as a pause function or an onlyOwner modifier for critical operations. While this promotes decentralization and immutability, it means there is no way to halt transfers or other token operations in the event of a critical vulnerability or exploit in an integrated DeFi protocol (7.3 Access Control, 7.8 Operations).
For a simple, fixed-supply token, this might be an intentional design choice. However, if the token is intended for use in complex DeFi ecosystems, consider implementing a well-designed, time-locked, and multi-sig controlled emergency pause mechanism to mitigate unforeseen risks. This should be balanced against the desire for decentralization and immutability.
Unresolved
The UaiToken contract heavily relies on battle-tested OpenZeppelin contracts (ERC20, ERC20Permit, ECDSA, EIP712, Nonces). This significantly reduces the likelihood of common vulnerabilities like reentrancy or integer overflows within the core token logic, as these libraries are extensively audited.
While OpenZeppelin contracts are highly audited, it is crucial to ensure the specific versions used are free from known vulnerabilities. Regularly monitor OpenZeppelin security advisories and community updates for any potential issues in the dependencies.
Unresolved
permit function, while providing gasless approvals, is susceptible to front-running. An attacker observing a signed permit message off-chain could submit their own transaction with a higher gas price, effectively 'stealing' the approval before the legitimate user's transaction is confirmed. This is an inherent characteristic of the permit mechanism and not a flaw in the contract's implementation.I-02The permit function, while providing gasless approvals, is susceptible to front-running. An attacker observing a signed permit message off-chain could submit their own transaction with a higher gas price, effectively 'stealing' the approval before the legitimate user's transaction is confirmed. This is an inherent characteristic of the permit mechanism and not a flaw in the contract's implementation.
Users should be aware of this risk when using permit. Projects integrating permit should consider mechanisms to mitigate front-running, such as using a relayer network that can submit transactions privately or educating users on best practices for transaction submission.
Unresolved
The UaiToken contract implements a standard ERC20 token with ERC20Permit functionality, leveraging battle-tested OpenZeppelin libraries. The contract is simple, with no complex logic or external integrations beyond its core token features. Identified risks are primarily informational or low-severity, related to inherent ERC20Permit characteristics and operational considerations for initial token distribution and emergency controls.
The UaiToken contract (7.1 Architecture, 7.2 Code Security) is a straightforward ERC20 implementation, inheriting extensively from OpenZeppelin's audited contracts for ERC20 and ERC20Permit. This significantly reduces the attack surface and mitigates common vulnerabilities like reentrancy and integer overflows, as OpenZeppelin's _update function correctly handles unchecked arithmetic and reverts on insufficient balances. The contract's simplicity and reliance on well-vetted libraries contribute to a high level of code security.
The UaiToken contract (7.4 Economic, 7.5 Governance) implements a fixed-supply model, minting all tokens to a single recipient during deployment, which is a common initial distribution strategy. There are no governance mechanisms or administrative functions for minting, burning, or pausing, promoting decentralization. However, the initial centralized distribution to a single address introduces an operational risk regarding the security of that specific address.
The UaiToken contract (7.7 Upgrades) is not designed as an upgradeable proxy. It is a standard, immutable contract. Therefore, there are no upgrade-related risks or complexities to consider, ensuring predictable and unchanging behavior post-deployment.
Ensure the initial recipient address for the token supply is secured with robust multi-signature controls and cold storage practices to mitigate the risk of centralized asset control.
While the lack of emergency controls promotes decentralization, consider the implications for potential future integrations within complex DeFi ecosystems. Thoroughly test any external protocols integrating with UaiToken to ensure compatibility and security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The UnifAI (UAI) contract on BNB Chain is 0x3e5d4f8aee0d9b3082d5f6da5d6e225d17ba9ea0. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for UnifAI is 45/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $7.8K.
As of Sep 4, 2026, the 10 largest holders own 92.3% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
