Quantum Audit Logo

Is vAPI Network a Scam?

Early-stage security check — honeypot & rug-pull analysis

vAPI Network VAPI
0x1ea8…8dd2
Base Not verifiedLast checked 3d ago 1 audit on record New Launch · 1d old
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

The audit of the Token contract, an ERC-20 token, revealed a generally robust technical implementation leveraging OpenZeppelin's battle-tested libraries. The primary concern identified is the highly centralized initial distribution of the entire token supply to a single recipient, which poses significant economic and governance risks.

1 High3 Informational
! Early-stage analysis. This token has limited on-chain history (1d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.
Volume 24h
$86.4K
Liquidity
$544.5K
Price
$0.08242
Token Age
1d
Top 10 Holders
37.8%

Security Findings

1 High3 Info
High

Centralized Initial Supply Distribution

H-01The `Token` contract's constructor mints the entire `TOTAL_SUPPLY` (100,000,000 tokens) to a single `recipient` address. This design choice results in a highly centralized initial distribution, granting the recipient complete control over the token supply. This centralization can lead to significant market manipulation risks, lack of decentralization, and potential single point of failure for the token's ecosystem.
IssueThe `Token` contract's constructor mints the entire `TOTAL_SUPPLY` (100,000,000 tokens) to a single `recipient` address. This design choice results in a highly centralized initial distribution, granting the recipient complete control over the token supply. This centralization can lead to significant market manipulation risks, lack of decentralization, and potential single point of failure for the token's ecosystem.
FixIf decentralization is a goal, consider implementing a more distributed initial supply mechanism. This could involve a vesting contract, a multi-signature wallet for the recipient, a public sale, or a phased distribution strategy. Clearly communicate the distribution strategy to stakeholders.
StatusUnresolved
Info

Reliance on OpenZeppelin Libraries

I-01The contract extensively utilizes battle-tested OpenZeppelin contracts (ERC20, ERC20Burnable, ERC20Permit). This is a strong security practice as these libraries are widely audited and maintained. However, it also means that any undiscovered vulnerability in the specific versions of the OpenZeppelin contracts used would directly impact this token.
IssueThe contract extensively utilizes battle-tested OpenZeppelin contracts (ERC20, ERC20Burnable, ERC20Permit). This is a strong security practice as these libraries are widely audited and maintained. However, it also means that any undiscovered vulnerability in the specific versions of the OpenZeppelin contracts used would directly impact this token.
FixRegularly monitor OpenZeppelin security advisories and consider upgrading to newer versions of the libraries if critical vulnerabilities are patched. Ensure the exact versions of OpenZeppelin contracts used are pinned in the `package.json` or equivalent dependency management system.
StatusUnresolved
Info

Immutability of Token Parameters

I-02The token's name, symbol, decimals (fixed at 18), and `TOTAL_SUPPLY` are set as constants or in the constructor and cannot be modified after deployment. While this provides predictability and transparency, it removes any flexibility for future adjustments, such as re-branding or supply modifications, which might be desired in some long-term project roadmaps.
IssueThe token's name, symbol, decimals (fixed at 18), and `TOTAL_SUPPLY` are set as constants or in the constructor and cannot be modified after deployment. While this provides predictability and transparency, it removes any flexibility for future adjustments, such as re-branding or supply modifications, which might be desired in some long-term project roadmaps.
FixThis is a design choice inherent to standard ERC-20 tokens. Ensure that the project's long-term vision aligns with these immutable parameters. If future flexibility is desired, an upgradeable token contract or a different tokenomics model would be required.
StatusUnresolved
Info

Fixed Solidity Compiler Version

I-03The contract specifies a fixed Solidity compiler version `pragma solidity 0.8.35;`. While this prevents unexpected behavior from future compiler changes, it might miss out on minor bug fixes or optimizations introduced in newer patch versions within the 0.8.x series.
IssueThe contract specifies a fixed Solidity compiler version `pragma solidity 0.8.35;`. While this prevents unexpected behavior from future compiler changes, it might miss out on minor bug fixes or optimizations introduced in newer patch versions within the 0.8.x series.
FixConsider using a floating pragma (e.g., `^0.8.35`) if minor patch updates are desired, or regularly review and update the fixed version to the latest stable patch within the major version if no breaking changes are introduced. Always test thoroughly after any compiler version change.
StatusUnresolved

Category Ratings

TechnicalLow9/10

The contract demonstrates strong technical security by inheriting from OpenZeppelin's ERC20, ERC20Burnable, and ERC20Permit libraries, which are widely audited and considered secure (7.2 Code Security). Standard ERC20 functionalities like transfers, approvals, and burning are implemented correctly. The use of Solidity 0.8.35 ensures protection against integer overflows/underflows by default, except in explicitly `unchecked` blocks which are used appropriately within OZ logic. No reentrancy or other common technical vulnerabilities were found (7.2 Code Security).

GovernanceMedium4/10

The contract's economic model is straightforward, with a clearly defined `TOTAL_SUPPLY` and initial distribution mechanism (7.4 Economic). However, this model introduces a high centralization risk as the entire token supply is minted to a single `recipient` address during deployment. This grants the initial recipient complete control over the token's distribution and potential market influence, lacking any on-chain governance mechanisms (7.5 Governance) for broader community input.

UpgradesLow7/10

The contract is not designed to be upgradeable, as indicated by `is_proxy: false` in the provided information (7.7 Upgrades). This eliminates upgrade-related risks such as proxy misconfigurations or logic inconsistencies between implementation versions. The immutability of the contract ensures predictable behavior post-deployment.

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionPass
Liquidity LockedPass
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

37.8% in top 10
6.1% in wallets31.8% in contracts
Effective Concentration18.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$544.5K across 2 pairs
Uniswap v4ETHanalysed$544.5K100.0%Uniswap v4USDC$30.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Locked64.8% · UNCX V4 Lock
Top-1 Unlocked Holder35.2%
Top-3 Unlocked35.2%

Key Addresses

2 addresses
Deployer
0x4cc2…6945
Unlocked LP Held By
0x40ee…3abb

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

3 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Token age < 7 days (early, volatile)
  • 1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Keeta (KTA)Low RiskApple Inc. (AAPLC)Low RiskSAIRILow RiskEdelLow RiskBario Entertainment System (BAES)Low RiskCoinbase Wrapped Hyperliquid (CBHYPE)Low Risk

Would You Like a More Detailed Audit of vAPI Network?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit