Quantum Audit Logo

Is ViciCoin Safe?

On-chain security analysis — is it a scam or legit?

ViciCoin VCNT
0xdcf5…bfd0
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

This audit covers a TransparentUpgradeableProxy contract, a standard OpenZeppelin implementation. While the proxy contract itself is well-audited and robust, the security posture is significantly impacted by the unverified implementation contract it points to and the unknown security setup of its administrative control. These factors introduce substantial risks related to potential malicious upgrades and lack of transparency.

2 High1 Medium1 Low
Volume 24h
$109.2K
Liquidity
$181.8K
Price
$18.9100
Token Age
2y
Top 10 Holders
82.2%

Security Findings

2 High1 Med1 Low
High

Unverified Implementation Contract

H-01The implementation contract at address 0xa0f7…1296 is not verified on Etherscan. This prevents any security analysis of the actual business logic that the proxy delegates to. Without verified source code, it is impossible to ascertain the contract's functionality, identify vulnerabilities, or confirm its intended behavior, posing a critical trust and security risk.
IssueThe implementation contract at address is not verified on Etherscan. This prevents any security analysis of the actual business logic that the proxy delegates to. Without verified source code, it is impossible to ascertain the contract's functionality, identify vulnerabilities, or confirm its intended behavior, posing a critical trust and security risk.
FixImmediately verify the source code of the implementation contract on Etherscan. This is crucial for transparency, allowing users and auditors to understand and trust the underlying logic. Conduct a thorough audit of the implementation contract once its source code is available.
StatusUnresolved
High

Centralized Upgrade Authority and Unknown Admin Setup

H-02The proxy's upgradeability and administrative functions are controlled by a single admin address. The prefill data indicates that the `admin_address` and `admin_kind` are null, suggesting the admin's security setup is not clearly identified or is not a standard `ProxyAdmin` contract. If this admin key is an Externally Owned Account (EOA) and is compromised, an attacker could upgrade the contract to a malicious implementation, leading to a complete loss of funds or control over the protocol.
IssueThe proxy's upgradeability and administrative functions are controlled by a single admin address. The prefill data indicates that the `admin_address` and `admin_kind` are null, suggesting the admin's security setup is not clearly identified or is not a standard `ProxyAdmin` contract. If this admin key is an Externally Owned Account (EOA) and is compromised, an attacker could upgrade the contract to a malicious implementation, leading to a complete loss of funds or control over the protocol.
FixSecure the admin key using a robust mechanism such as a multi-signature wallet (e.g., Gnosis Safe) or deploy a dedicated `ProxyAdmin` contract to manage the proxy. Ensure the admin address is publicly known and its security setup is transparent. Implement strict operational procedures for managing the admin key and executing upgrades.
StatusUnresolved
Medium

Potential for Malicious or Buggy Upgrades

M-01The upgradeability feature allows the contract's logic to be changed at any time by the admin. While this offers flexibility, it also introduces the risk that a new implementation could contain critical bugs, introduce backdoors, or deviate from expected functionality. This risk is exacerbated by the current unverified implementation, making it impossible to assess the baseline security.
IssueThe upgradeability feature allows the contract's logic to be changed at any time by the admin. While this offers flexibility, it also introduces the risk that a new implementation could contain critical bugs, introduce backdoors, or deviate from expected functionality. This risk is exacerbated by the current unverified implementation, making it impossible to assess the baseline security.
FixEstablish a rigorous upgrade process that includes comprehensive testing, independent security audits, and a public review period for all new implementation versions before they are deployed. Consider implementing a timelock for upgrades to provide users with a window to react to potentially malicious changes. Ensure all new implementations are thoroughly verified on Etherscan.
StatusUnresolved
Low

Admin Cannot Directly Call Implementation Functions

L-01The Transparent Proxy pattern explicitly prevents the admin address from directly calling functions on the implementation contract via the proxy's fallback function. This is a security feature to prevent selector clashes with proxy admin functions. However, it can lead to unexpected errors or confusion if the admin attempts to interact with the implementation directly through the proxy, requiring them to use a non-admin account or a `ProxyAdmin` contract.
IssueThe Transparent Proxy pattern explicitly prevents the admin address from directly calling functions on the implementation contract via the proxy's fallback function. This is a security feature to prevent selector clashes with proxy admin functions. However, it can lead to unexpected errors or confusion if the admin attempts to interact with the implementation directly through the proxy, requiring them to use a non-admin account or a `ProxyAdmin` contract.
FixEnsure all administrators are fully aware of the Transparent Proxy pattern's behavior, specifically that they cannot call implementation functions directly through the proxy. If direct interaction with the implementation is required for administrative tasks, it should be done via a non-admin account or through a dedicated `ProxyAdmin` contract, which is designed to manage the proxy.
StatusUnresolved

Category Ratings

TechnicalLow7/10

The TransparentUpgradeableProxy contract itself is a robust and well-audited OpenZeppelin component (7.2 Code Security). It correctly implements the transparent proxy pattern, preventing selector clashes. However, the primary technical risk stems from the unverified implementation contract (7.6 External), which prevents any security assessment of the actual business logic. This lack of visibility into the implementation's code is a critical vulnerability, as any flaw or malicious logic within it would directly affect the proxy's users.

GovernanceHigh3/10

The contract's economic and governance security is heavily dependent on the administrative control (7.3 Access Control, 7.5 Governance). The proxy allows a single admin address to initiate upgrades and change the admin itself. The prefill data indicates the admin address is not clearly identified or is not a standard ProxyAdmin contract, which raises concerns about its security. A compromised admin key could lead to a complete loss of funds or control through a malicious upgrade (7.4 Economic).

UpgradesHigh2/10

The contract utilizes the Transparent Proxy pattern for upgradeability (7.7 Upgrades), allowing the implementation logic to be changed. While the mechanism itself is standard, the unverified nature of the current implementation contract (7.6 External) and the centralized control over upgrades (7.3 Access Control) introduce significant risks. Any upgrade to a faulty or malicious implementation could lead to severe consequences, and without verified source code for the implementation, the safety of future upgrades cannot be assessed.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

82.2% in top 10
54.2% in wallets28.0% in contracts
Effective Concentration65.4%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$495.4K across 6 pairs
Uniswap v3USDCanalysed$181.8K36.7%Uniswap v3WETH$80.5K16.2%Uniswap v3USDbC$62.6K12.6%Uniswap v3EURC$61.0K12.3%Uniswap v3cbETH$54.9K11.1%Uniswap v3cbBTC$54.6K11.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder24.3%
Top-3 Unlocked61.6%

Key Addresses

11 addresses
Deployer
0x4c18…7112
Unlocked LP Held By
0x575e…fe980x8cfa…9d640x4cc4…2ee20xac6d…a23e0xb00e…bed10xf4c0…767e0xd1d3…85320xf36d…edae0x5810…8eaf0x9356…ebe2

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
  • Proxy contract (upgradeable — admin can replace logic)
  • OZ ProxyAdmin -> Admin is unclassified contract
  • Top-10 concentration > 50% (82.2% total → 65.4% effective; 54.2% in EOAs, 28.0% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
gitlawbHigh RiskWrapped liquid staked Ether 2.0 (WSTETH)High RiskSuperform (UP)High RiskaeonHigh RiskCoinbase Wrapped Staked ETH (CBETH)High RiskThe Innovation Game (TIG)High Risk

Would You Like a More Detailed Audit of ViciCoin?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit