Is UnifAI (UAI) Safe? Smart Contract Security Analysis

Security Findings

2 Low2 Info

Low

Centralized Initial Token Distribution

L-01The entire token supply (1,000,000,000 UAI with 18 decimals) is minted to a single `recipient` address during contract deployment. This makes the security of the entire token supply highly dependent on the security of this single address. A compromise of this address would lead to the loss of all tokens, representing a significant operational risk (7.8 Operations).

IssueThe entire token supply (1,000,000,000 UAI with 18 decimals) is minted to a single `recipient` address during contract deployment. This makes the security of the entire token supply highly dependent on the security of this single address. A compromise of this address would lead to the loss of all tokens, representing a significant operational risk (7.8 Operations).

FixThe `recipient` address should be a highly secured multi-signature wallet or a cold storage address. Consider distributing the initial supply across multiple secure addresses or a vesting contract to reduce single points of failure and enhance overall security posture.

StatusUnresolved

Low

Lack of Emergency Control Mechanisms

L-02The UaiToken contract does not include any emergency control mechanisms such as a `pause` function or an `onlyOwner` modifier for critical operations. While this promotes decentralization and immutability, it means there is no way to halt transfers or other token operations in the event of a critical vulnerability or exploit in an integrated DeFi protocol (7.3 Access Control, 7.8 Operations).

IssueThe UaiToken contract does not include any emergency control mechanisms such as a `pause` function or an `onlyOwner` modifier for critical operations. While this promotes decentralization and immutability, it means there is no way to halt transfers or other token operations in the event of a critical vulnerability or exploit in an integrated DeFi protocol (7.3 Access Control, 7.8 Operations).

FixFor a simple, fixed-supply token, this might be an intentional design choice. However, if the token is intended for use in complex DeFi ecosystems, consider implementing a well-designed, time-locked, and multi-sig controlled emergency pause mechanism to mitigate unforeseen risks. This should be balanced against the desire for decentralization and immutability.

StatusUnresolved

Info

Reliance on Third-Party Libraries

I-01The UaiToken contract heavily relies on battle-tested OpenZeppelin contracts (ERC20, ERC20Permit, ECDSA, EIP712, Nonces). This significantly reduces the likelihood of common vulnerabilities like reentrancy or integer overflows within the core token logic, as these libraries are extensively audited.

IssueThe UaiToken contract heavily relies on battle-tested OpenZeppelin contracts (ERC20, ERC20Permit, ECDSA, EIP712, Nonces). This significantly reduces the likelihood of common vulnerabilities like reentrancy or integer overflows within the core token logic, as these libraries are extensively audited.

FixWhile OpenZeppelin contracts are highly audited, it is crucial to ensure the specific versions used are free from known vulnerabilities. Regularly monitor OpenZeppelin security advisories and community updates for any potential issues in the dependencies.

StatusUnresolved

Info

Inherent Front-Running Risk in ERC20Permit

I-02The `permit` function, while providing gasless approvals, is susceptible to front-running. An attacker observing a signed `permit` message off-chain could submit their own transaction with a higher gas price, effectively 'stealing' the approval before the legitimate user's transaction is confirmed. This is an inherent characteristic of the `permit` mechanism and not a flaw in the contract's implementation.

IssueThe `permit` function, while providing gasless approvals, is susceptible to front-running. An attacker observing a signed `permit` message off-chain could submit their own transaction with a higher gas price, effectively 'stealing' the approval before the legitimate user's transaction is confirmed. This is an inherent characteristic of the `permit` mechanism and not a flaw in the contract's implementation.

FixUsers should be aware of this risk when using `permit`. Projects integrating `permit` should consider mechanisms to mitigate front-running, such as using a relayer network that can submit transactions privately or educating users on best practices for transaction submission.

StatusUnresolved

Category Ratings

TechnicalLow8/10

The UaiToken contract (7.1 Architecture, 7.2 Code Security) is a straightforward ERC20 implementation, inheriting extensively from OpenZeppelin's audited contracts for ERC20 and ERC20Permit. This significantly reduces the attack surface and mitigates common vulnerabilities like reentrancy and integer overflows, as OpenZeppelin's `_update` function correctly handles `unchecked` arithmetic and reverts on insufficient balances. The contract's simplicity and reliance on well-vetted libraries contribute to a high level of code security.

GovernanceHigh1/10

The UaiToken contract (7.4 Economic, 7.5 Governance) implements a fixed-supply model, minting all tokens to a single recipient during deployment, which is a common initial distribution strategy. There are no governance mechanisms or administrative functions for minting, burning, or pausing, promoting decentralization. However, the initial centralized distribution to a single address introduces an operational risk regarding the security of that specific address.

UpgradesMedium6/10

The UaiToken contract (7.7 Upgrades) is not designed as an upgradeable proxy. It is a standard, immutable contract. Therefore, there are no upgrade-related risks or complexities to consider, ensuring predictable and unchanging behavior post-deployment.

Security Checklist

3/5 checks passed

Contract VerifiedPass

Ownership Renounced?

No Mint FunctionPass

Liquidity LockedFail

Not a ProxyPass

HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

92.3% in top 10

7.7% in wallets84.6% in contracts

Effective Concentration41.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$7.8K across 3 pairs

UniswapUSDTanalysed$7.5K Pancakeswap v3USDT$323 Pancakeswap v2Subject 3$20

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder97.3%

Top-3 Unlocked100.0%

Key Addresses

5 addresses

Deployer

0x7917…a8a1

Unlocked LP Held By

0x76b1…51ec0x578a…ca520x125a…f1c60xb69b…6097

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

7 factors

Ownership status UNKNOWN (owner could not be resolved)
Top-10 concentration > 30% (92.3% total → 41.5% effective; 7.7% in EOAs, 84.6% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
Liquidity < $10k ($7,836 across 3 pairs — easily drained)
LP top1 unlocked holder = 97.3% (independent LP — depth risk, pool = 96% of DEX liquidity)
LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 96% of DEX liquidity)
2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Is UnifAI Safe?

Security Findings

Centralized Initial Token Distribution

Lack of Emergency Control Mechanisms

Reliance on Third-Party Libraries

Inherent Front-Running Risk in ERC20Permit

Category Ratings

Security Checklist

Holder Composition

Liquidity Depth

LP Distribution

Key Addresses

What Raised This Score

Related Audits

Would You Like a More Detailed Audit of UnifAI?