Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Vestra DAO Safe?

VSTREthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades8/10Checks passed4 of 5Findings1 High · 1 Medium · 1 Low · 1 Info4
SummaryAI Copilot

The VestraDAO token contract is an ERC20 token with added burnable and permit functionalities, incorporating a blacklist mechanism that relies on an external DAO contract.

Read the full analysis
What raised the score
  • Top-10 concentration > 30%
  • Liquidity not locked
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Top-10 concentration > 30% (98.6% total → 39.4% effective; 0.0% in EOAs, 98.6% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • LP top1 unlocked holder = 100.0% (exit-liquidity risk, pool = 100% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (exit-liquidity risk, pool = 100% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 44 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
98.6%Contracts1.4%
98.6%Contracts
ContractsEveryone elseBubble area = share of supply
98.6%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking98.6%
  • Everyone elsethe rest of the supply1.4%
Effective concentrationwhat the score reads39.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$930.0K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$928.9KShare of depth99.9%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x7339…ae81

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

Security Findings

1 High1 Medium1 Low1 Info
High

Immutable and Critical External Dependency for Blacklist

The VestraDAO contract relies on an external IDAO contract, specified by the dao address, for its core blacklist functionality. The setDaoAddress function, which sets this critical dependency, is onlyOwner. Given that ownership has been renounced, the dao address is now immutable. This means if the external IDAO contract at the specified address is compromised, becomes malicious, or requires an update (e.g., due to a vulnerability or change in project governance), the VestraDAO token cannot update its dependency. This could lead to permanent fund locks for legitimate users, arbitrary blacklisting, or a complete breakdown of token functionality without any recourse.H-01

Issue

The VestraDAO contract relies on an external IDAO contract, specified by the dao address, for its core blacklist functionality. The setDaoAddress function, which sets this critical dependency, is onlyOwner. Given that ownership has been renounced, the dao address is now immutable. This means if the external IDAO contract at the specified address is compromised, becomes malicious, or requires an update (e.g., due to a vulnerability or change in project governance), the VestraDAO token cannot update its dependency. This could lead to permanent fund locks for legitimate users, arbitrary blacklisting, or a complete breakdown of token functionality without any recourse.

Fix

Ensure the IDAO contract at the set dao address is exceptionally secure, thoroughly audited, and has a robust, decentralized governance model. Since the address is immutable, any future issues with the IDAO contract cannot be mitigated by the VestraDAO token. Consider a design where the blacklist authority is more resilient or can be updated through a community-governed process, even if the token contract itself is immutable.

Status

Unresolved

Medium

Blacklist Mechanism Operational Risk Post-Renunciation

The dao address, which is critical for the blacklist functionality, is initialized to address(0) and can only be set once by the owner via setDaoAddress. If the owner renounced ownership *before* calling setDaoAddress with a valid IDAO contract address, the dao variable would remain address(0). Subsequent calls to isBlackList would attempt to interact with IDAO(address(0)), which will always revert. This would render all core token functions (transfer, approve, transferFrom, burn, burnFrom) unusable, effectively locking all tokens and making the contract inoperable.M-01

Issue

The dao address, which is critical for the blacklist functionality, is initialized to address(0) and can only be set once by the owner via setDaoAddress. If the owner renounced ownership *before* calling setDaoAddress with a valid IDAO contract address, the dao variable would remain address(0). Subsequent calls to isBlackList would attempt to interact with IDAO(address(0)), which will always revert. This would render all core token functions (transfer, approve, transferFrom, burn, burnFrom) unusable, effectively locking all tokens and making the contract inoperable.

Fix

Verify that the dao address was correctly set to a valid and functional IDAO contract address immediately after deployment and *before* ownership was renounced. For future deployments, ensure a strict deployment checklist is followed to prevent such operational failures. If the contract is already deployed and dao is address(0) with ownership renounced, the contract is effectively broken.

Status

Unresolved

Low

Lack of Emergency Pause Mechanism

The contract lacks a general pause mechanism (e.g., Pausable from OpenZeppelin) that could temporarily halt token transfers, approvals, or burns in the event of a critical vulnerability in an integrated DeFi protocol or a widespread exploit. While the blacklist can restrict individual accounts, it cannot provide a global emergency stop. This limits the ability to react swiftly to unforeseen, systemic risks affecting the token or its ecosystem.L-01

Issue

The contract lacks a general pause mechanism (e.g., Pausable from OpenZeppelin) that could temporarily halt token transfers, approvals, or burns in the event of a critical vulnerability in an integrated DeFi protocol or a widespread exploit. While the blacklist can restrict individual accounts, it cannot provide a global emergency stop. This limits the ability to react swiftly to unforeseen, systemic risks affecting the token or its ecosystem.

Fix

Consider implementing a pause functionality, ideally controlled by a multi-signature wallet or a decentralized governance mechanism. This would allow for a rapid response to critical situations, protecting user funds and the protocol's integrity. However, given the contract's immutability, this would require a redeployment.

Status

Unresolved

Info

Initial Token Distribution Centralization

The constructor mints the entire initial supply of 50,000,000,000 tokens (adjusted for decimals) directly to the initialOwner. This results in a highly centralized initial distribution, granting significant control and influence over the token's ecosystem to a single address. While not a direct vulnerability, this centralization can pose governance and market manipulation risks.I-01

Issue

The constructor mints the entire initial supply of 50,000,000,000 tokens (adjusted for decimals) directly to the initialOwner. This results in a highly centralized initial distribution, granting significant control and influence over the token's ecosystem to a single address. While not a direct vulnerability, this centralization can pose governance and market manipulation risks.

Fix

For future token designs, consider a more distributed initial token allocation strategy, potentially involving vesting schedules, community airdrops, or multi-signature controlled treasuries to mitigate centralization risks and foster broader participation.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The VestraDAO token contract is an ERC20 token with added burnable and permit functionalities, incorporating a blacklist mechanism that relies on an external DAO contract. The contract utilizes well-audited OpenZeppelin libraries, contributing to its foundational security. However, the core blacklist functionality introduces significant centralization and immutability risks, especially given that ownership has been renounced. The reliance on an external, immutable DAO address for blacklisting, coupled with the potential for operational failure if not configured correctly, elevates the overall risk profile to High.

Technical8/10Low risk

The VestraDAO contract is built upon robust OpenZeppelin ERC20, ERC20Burnable, Ownable, and ERC20Permit implementations, ensuring a solid foundation for standard token operations (7.2 Code Security). Custom logic primarily involves adding blacklist checks to transfer, approve, and burn functions, which are straightforward and do not introduce complex arithmetic or reentrancy vectors. However, the contract's architecture (7.1 Architecture) introduces a critical external dependency on an IDAO contract for blacklisting, which is called in every restricted transaction. This dependency, combined with the immutability of the dao address after ownership renunciation, presents a significant technical risk if the external contract is compromised or misconfigured.

Governance1/10High risk

The economic model centers around an ERC20 token with a blacklist feature. A significant economic risk (7.4 Economic) stems from the initial minting of 50 billion tokens to the initialOwner, granting substantial control to a single entity. The blacklist mechanism, while intended for security, introduces a high degree of centralization. With ownership renounced, the dao address (which controls blacklisting) becomes immutable. This means there is no governance (7.5 Governance) mechanism to update or change the blacklist authority if it becomes compromised or malicious, potentially leading to permanent fund locks for blacklisted users without recourse. This immutability also means the project cannot adapt to changes in the external IDAO contract's functionality or address.

Upgrades8/10Low risk

The VestraDAO contract is not designed with an upgrade mechanism (7.7 Upgrades). It is a standard, non-proxy contract, meaning its logic is immutable once deployed. This eliminates risks associated with upgradeability patterns (e.g., proxy storage collisions, upgrade path vulnerabilities) but also means that any discovered vulnerabilities or desired feature enhancements cannot be implemented without a complete redeployment and migration.

Final RecommendationWhat to do about this score

Given the high centralization and immutability of the blacklist mechanism, it is crucial to ensure the dao address points to an extremely robust and secure IDAO contract.

Thoroughly audit the IDAO contract and its governance model to mitigate the risk of arbitrary blacklisting or compromise. Consider implementing a multi-signature wallet for the IDAO contract's control to distribute authority. For future iterations, evaluate the trade-offs of immutability versus the need for emergency response or adaptability, potentially exploring upgradeable contract patterns with robust governance for critical components.

Contract & Record

1 audit on record
TypeToken
NetworkEthereum
Token age1y
Contract0x92d5…b434
Deployer0x7339…ae81
Badge for your website
Vestra DAO security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 11, 202647Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the VSTR contract address?

The Vestra DAO (VSTR) contract on Ethereum is 0x92d5942f468447f1f21c2092580f15544923b434. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Vestra DAO a scam?

Quantum Audit's risk score for Vestra DAO is 47/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is VSTR liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $930.0K.

Who holds VSTR?

As of Sep 4, 2026, the 10 largest holders own 98.6% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Safe TokenSAFE · Ethereum47MediumLQTYEthereum47MediumMOMOEthereum47MediumDog Food TokenOISHII · Ethereum47MediumSuperRareRARE · Ethereum47MediumMAGATRUMP · Ethereum47Medium

Would You Like a More Detailed Audit of Vestra DAO?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page