On-chain security analysis — is it a scam or legit?
This audit covers a TransparentUpgradeableProxy contract, a standard OpenZeppelin implementation.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x575e…fe980x8cfa…9d640x4cc4…2ee20xac6d…a23e0xb00e…bed10xf4c0…767e0xd1d3…85320xf36d…edae0x5810…8eaf0x9356…ebe2No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The implementation contract at address is not verified on Etherscan. This prevents any security analysis of the actual business logic that the proxy delegates to. Without verified source code, it is impossible to ascertain the contract's functionality, identify vulnerabilities, or confirm its intended behavior, posing a critical trust and security risk.
Immediately verify the source code of the implementation contract on Etherscan. This is crucial for transparency, allowing users and auditors to understand and trust the underlying logic. Conduct a thorough audit of the implementation contract once its source code is available.
Unresolved
admin_address and admin_kind are null, suggesting the admin's security setup is not clearly identified or is not a standard ProxyAdmin contract. If this admin key is an Externally Owned Account (EOA) and is compromised, an attacker could upgrade the contract to a malicious implementation, leading to a complete loss of funds or control over the protocol.H-02The proxy's upgradeability and administrative functions are controlled by a single admin address. The prefill data indicates that the admin_address and admin_kind are null, suggesting the admin's security setup is not clearly identified or is not a standard ProxyAdmin contract. If this admin key is an Externally Owned Account (EOA) and is compromised, an attacker could upgrade the contract to a malicious implementation, leading to a complete loss of funds or control over the protocol.
Secure the admin key using a robust mechanism such as a multi-signature wallet (e.g., Gnosis Safe) or deploy a dedicated ProxyAdmin contract to manage the proxy. Ensure the admin address is publicly known and its security setup is transparent. Implement strict operational procedures for managing the admin key and executing upgrades.
Unresolved
The upgradeability feature allows the contract's logic to be changed at any time by the admin. While this offers flexibility, it also introduces the risk that a new implementation could contain critical bugs, introduce backdoors, or deviate from expected functionality. This risk is exacerbated by the current unverified implementation, making it impossible to assess the baseline security.
Establish a rigorous upgrade process that includes comprehensive testing, independent security audits, and a public review period for all new implementation versions before they are deployed. Consider implementing a timelock for upgrades to provide users with a window to react to potentially malicious changes. Ensure all new implementations are thoroughly verified on Etherscan.
Unresolved
ProxyAdmin contract.L-01The Transparent Proxy pattern explicitly prevents the admin address from directly calling functions on the implementation contract via the proxy's fallback function. This is a security feature to prevent selector clashes with proxy admin functions. However, it can lead to unexpected errors or confusion if the admin attempts to interact with the implementation directly through the proxy, requiring them to use a non-admin account or a ProxyAdmin contract.
Ensure all administrators are fully aware of the Transparent Proxy pattern's behavior, specifically that they cannot call implementation functions directly through the proxy. If direct interaction with the implementation is required for administrative tasks, it should be done via a non-admin account or through a dedicated ProxyAdmin contract, which is designed to manage the proxy.
Unresolved
This audit covers a TransparentUpgradeableProxy contract, a standard OpenZeppelin implementation. While the proxy contract itself is well-audited and robust, the security posture is significantly impacted by the unverified implementation contract it points to and the unknown security setup of its administrative control. These factors introduce substantial risks related to potential malicious upgrades and lack of transparency.
The TransparentUpgradeableProxy contract itself is a robust and well-audited OpenZeppelin component (7.2 Code Security). It correctly implements the transparent proxy pattern, preventing selector clashes. However, the primary technical risk stems from the unverified implementation contract (7.6 External), which prevents any security assessment of the actual business logic. This lack of visibility into the implementation's code is a critical vulnerability, as any flaw or malicious logic within it would directly affect the proxy's users.
The contract's economic and governance security is heavily dependent on the administrative control (7.3 Access Control, 7.5 Governance). The proxy allows a single admin address to initiate upgrades and change the admin itself. The prefill data indicates the admin address is not clearly identified or is not a standard ProxyAdmin contract, which raises concerns about its security. A compromised admin key could lead to a complete loss of funds or control through a malicious upgrade (7.4 Economic).
The contract utilizes the Transparent Proxy pattern for upgradeability (7.7 Upgrades), allowing the implementation logic to be changed. While the mechanism itself is standard, the unverified nature of the current implementation contract (7.6 External) and the centralized control over upgrades (7.3 Access Control) introduce significant risks. Any upgrade to a faulty or malicious implementation could lead to severe consequences, and without verified source code for the implementation, the safety of future upgrades cannot be assessed.
Prioritize verifying the source code of the current implementation contract to enable a full security assessment.
Implement robust security measures for the admin key, such as a multi-signature wallet or a dedicated ProxyAdmin contract, to mitigate the risk of a single point of failure. Establish a clear and secure upgrade process, including thorough testing and auditing of all new implementation versions before deployment to the production proxy.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The ViciCoin (VCNT) contract on Base is 0xdcf5130274753c8050ab061b1a1dcbf583f5bfd0. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for ViciCoin is 47/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $495.4K.
As of Sep 4, 2026, the 10 largest holders own 82.2% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
