Quantum Audit Logo

Is USELESS COIN Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

USELESS COIN USELESS
0xba38…6d2b
BNB Chain Not verifiedLast checked 2d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The BurnMintERC20 token contract implements a standard ERC20 token with additional minting and burning capabilities, leveraging OpenZeppelin's AccessControl for role management. Key strengths include the use of battle-tested libraries, an immutable maximum supply, and explicit checks to prevent self-transfers. However, the contract exhibits a high degree of centralization, particularly concerning the `DEFAULT_ADMIN_ROLE`'s power to manage minter and burner roles, which directly impacts token supply. The purpose and security implications of the `s_ccipAdmin` role, an external dependency, are also not fully defined within this contract.

1 High1 Medium1 Low1 Informational
Volume 24h
$1.05M
Liquidity
$706.0K
Price
$0.2599
Token Age
1y
Top 10 Holders
88.8%

Security Findings

1 High1 Med1 Low1 Info
High

Centralized Control of Token Supply (Mint/Burn Roles)

H-01The `DEFAULT_ADMIN_ROLE` has the sole authority to grant `MINTER_ROLE` and `BURNER_ROLE`. Holders of these roles can mint new tokens (up to `i_maxSupply`) or burn existing tokens. If the `DEFAULT_ADMIN_ROLE` is compromised or misused, it could lead to arbitrary manipulation of the token supply, directly impacting the token's value and the economic stability of the protocol (7.3, 7.4, 7.5).
IssueThe `DEFAULT_ADMIN_ROLE` has the sole authority to grant `MINTER_ROLE` and `BURNER_ROLE`. Holders of these roles can mint new tokens (up to `i_maxSupply`) or burn existing tokens. If the `DEFAULT_ADMIN_ROLE` is compromised or misused, it could lead to arbitrary manipulation of the token supply, directly impacting the token's value and the economic stability of the protocol (7.3, 7.4, 7.5).
FixImplement a robust, decentralized, or multi-signature governance mechanism for the `DEFAULT_ADMIN_ROLE`. Consider a timelock for critical operations like granting `MINTER_ROLE` or `BURNER_ROLE` to provide a window for community review and intervention. Ensure that the addresses holding `MINTER_ROLE` and `BURNER_ROLE` are also secured by strong access control policies.
StatusUnresolved
Medium

Undefined External Dependency for `s_ccipAdmin` Role

M-01The contract defines an `s_ccipAdmin` state variable and an interface `IGetCCIPAdmin` to expose it, with the `DEFAULT_ADMIN_ROLE` able to set this address. However, the specific functionality and security implications of this `s_ccipAdmin` role are not defined within this contract and depend entirely on external CCIP systems (7.6). Misconfiguration or vulnerabilities in these external systems could indirectly affect the protocol's security or operations.
IssueThe contract defines an `s_ccipAdmin` state variable and an interface `IGetCCIPAdmin` to expose it, with the `DEFAULT_ADMIN_ROLE` able to set this address. However, the specific functionality and security implications of this `s_ccipAdmin` role are not defined within this contract and depend entirely on external CCIP systems (7.6). Misconfiguration or vulnerabilities in these external systems could indirectly affect the protocol's security or operations.
FixProvide comprehensive documentation detailing the intended use, responsibilities, and security model of the `s_ccipAdmin` role and its interaction with external CCIP systems. Conduct a thorough security review of any external contracts or protocols that rely on this `getCCIPAdmin` function to understand the full attack surface.
StatusUnresolved
Low

Initial Centralization of `DEFAULT_ADMIN_ROLE`

L-01The constructor assigns the `DEFAULT_ADMIN_ROLE` to `msg.sender` (the deployer). While common, this means that immediately after deployment, a single external owned account (EOA) holds complete administrative control over the contract (7.3, 7.8). If this EOA's private key is compromised before the role is transferred, the entire access control system could be subverted.
IssueThe constructor assigns the `DEFAULT_ADMIN_ROLE` to `msg.sender` (the deployer). While common, this means that immediately after deployment, a single external owned account (EOA) holds complete administrative control over the contract (7.3, 7.8). If this EOA's private key is compromised before the role is transferred, the entire access control system could be subverted.
FixIt is a best practice to transfer the `DEFAULT_ADMIN_ROLE` to a secure, multi-signature wallet or a robust governance contract immediately after deployment. This reduces the single point of failure risk associated with a single EOA.
StatusUnresolved
Info

Prevention of Self-Transfers/Approvals

I-01The `_transfer` and `_approve` functions explicitly revert if the recipient or spender is `address(this)`. This is a good security practice (7.2) that prevents tokens from being accidentally or maliciously sent to or approved by the contract itself, which could lead to tokens becoming unrecoverable or misused within the contract's balance.
IssueThe `_transfer` and `_approve` functions explicitly revert if the recipient or spender is `address(this)`. This is a good security practice (7.2) that prevents tokens from being accidentally or maliciously sent to or approved by the contract itself, which could lead to tokens becoming unrecoverable or misused within the contract's balance.
FixNo action required. This is a positive security measure.
StatusResolved

Category Ratings

TechnicalLow7/10

The contract leverages battle-tested OpenZeppelin libraries for ERC20, burning, and access control, enhancing code security (7.2). It implements robust checks to prevent tokens from being sent to or approved by the contract itself, improving operational safety. However, the `s_ccipAdmin` role's functionality is not defined within this contract, posing an external dependency risk (7.6) whose security implications are unclear. The use of `AccessControl` provides a clear framework for managing roles.

GovernanceMedium5/10

The token's economic model benefits from an immutable `maxSupply` (7.4), preventing uncontrolled inflation beyond a set limit. However, the `DEFAULT_ADMIN_ROLE` holds significant power, including the ability to grant `MINTER_ROLE` and `BURNER_ROLE` (7.5). This centralized control over token supply manipulation (minting up to `maxSupply` and burning) represents a high governance and economic risk (7.4, 7.5) if the admin key is compromised or misused. Initial deployment also places `DEFAULT_ADMIN_ROLE` solely with the deployer.

UpgradesMedium6/10

The contract is not designed to be upgradeable (7.7), which eliminates risks associated with proxy patterns and upgradeability mechanisms. This simplifies the architecture and reduces the attack surface related to upgrade logic. Consequently, there are no upgrade safety issues to address.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

88.8% in top 10
7.4% in wallets81.4% in contracts
Effective Concentration39.9%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$706.6K across 4 pairs
Pancakeswap v3WBNBanalysed$706.0K99.9%Pancakeswap v3USDT$5190.1%UniswapUSDT$950.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder98.7%
Top-3 Unlocked99.3%

Key Addresses

11 addresses
Deployer
0x92c9…9fc1
Unlocked LP Held By
0x0cd0…6e1e0x556b…d59e0x966d…e41a0xa80e…61f00x8e40…16f80x1190…f6bf0xe139…cae10xc64f…406d0x3443…10b60xce13…f41c

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (88.8% total → 39.9% effective; 7.4% in EOAs, 81.4% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 98.7% (independent LP — depth risk)
  • LP top3 unlocked holders = 99.3% (independent LP — depth risk)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
CRYSTAL STONESHigh RiskEthereum Token (ETH)High RiskBSquared Token (B2)High RiskBrokHigh Risko1.exchange (O)High RiskBaby Ansem (BABYANSEM)High Risk

Would You Like a More Detailed Audit of USELESS COIN?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit