On-chain security analysis — is it a scam or legit?
BNB ChainThe ERC677BridgeToken contract provides standard ERC-20 functionality with additional features for bridging and minting.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 15, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x0424…cb740x2f32…5e120xcd8b…b38a0x27c8…fa200xeae9…03410x603e…cf3b0xea9b…cf930x42f6…cecd0x62c9…9e83No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
transferAndCall(address,uint256,bytes) function. The static analysis indicates this function allows the owner to directly modify the token balances of any holder, meaning the owner could move tokens out of any address or even burn them without the holder's consent. This represents a critical centralization risk.CP-02The contract owner possesses a highly powerful capability through the transferAndCall(address,uint256,bytes) function. The static analysis indicates this function allows the owner to directly modify the token balances of any holder, meaning the owner could move tokens out of any address or even burn them without the holder's consent. This represents a critical centralization risk.
This capability gives the owner absolute control over all token balances. Token holders must understand that their tokens are subject to the owner's discretion. It is essential that the owner's private key is extremely well-protected, ideally by a multi-signature wallet with a strong governance process, to prevent malicious or accidental manipulation of funds.
Unresolved
mint(address,uint256) function. This means the owner can increase the total supply of tokens at any time, which could dilute the value of existing tokens held by others.CP-01The contract owner has the ability to create an unlimited number of new tokens using the mint(address,uint256) function. This means the owner can increase the total supply of tokens at any time, which could dilute the value of existing tokens held by others.
Token holders should be aware that the owner can inflate the token supply. It is crucial that the owner's address is controlled by a highly secure entity, such as a multi-signature wallet, and that there are clear policies governing when and how new tokens can be minted.
Unresolved
0.0% of the pool's LP is burned or time-locked. 0.7% still sits in DxLock, but that lock expired on 21 Nov 2022 — its owner can withdraw it at any moment. 99.3% is held, unlocked, by 5 address(es) other than the owner/deployer. One of them — a wallet, 0x0424…cb74 — holds 84.9% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $24K (DexScreener, all pools). 24h trading volume $80K (CoinGecko, all markets, daily snapshot). 24h trading volume $160K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.569 on 2022-01-04; the price is now 99.992% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The ten largest holders own 66.6% of supply. Of that, 35.4% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 21.8% in wallets, 9.3% in other contracts. 46,648 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Velas (VLX), rank #5394. 46,648 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: a ProxyAdmin contract. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $24K of DEX liquidity across 10 pools. Launch: 1864 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The ERC677BridgeToken contract provides standard ERC-20 functionality with additional features for bridging and minting. The contract owner retains significant control, including the ability to mint new tokens and directly manipulate token balances of other holders. These capabilities introduce substantial centralization risks, as a compromised or malicious owner could dilute existing token holders or arbitrarily move funds.
The contract implements the ERC-20 and ERC-677 standards, providing robust token transfer mechanisms (7.2 Code Security). It includes owner-restricted functions for managing token supply and bridge operations (7.3 Access Control). A key technical risk is the mint function, which allows the owner to increase the total supply, potentially diluting token value (CP-01). Furthermore, the transferAndCall function is identified as allowing the owner to directly change other holders' balances, which is a critical technical vulnerability (CP-02).
The contract's economic model is highly centralized, with the owner possessing extensive control over the token supply and individual balances (7.4 Economic). The owner, identified as an OZ_ProxyAdmin, can mint an arbitrary amount of new tokens via mint(address,uint256), leading to potential inflation and value dilution (CP-01). More critically, the owner can directly manipulate any holder's balance using transferAndCall(address,uint256,bytes), enabling arbitrary token movement or burning from any address (CP-02). This centralization poses a significant governance and economic risk (7.5 Governance).
The contract is not implemented as a proxy and does not include any upgrade mechanisms (7.7 Upgrades). This means the contract's logic is immutable once deployed, eliminating risks associated with upgradeability flaws such as improper initialization or storage collisions. However, it also means that any discovered vulnerabilities or desired feature changes cannot be addressed without a new deployment and migration.
Given the significant power vested in the contract owner, it is paramount to ensure the owner's private key is secured with the highest possible standards, ideally through a robust multi-signature wallet.
Implement strict operational procedures for executing privileged functions, especially mint and transferAndCall, to prevent unauthorized or erroneous actions. Consider implementing a timelock for critical operations to provide a window for community review and reaction.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
