Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Vision Safe?

VSNEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical3/10Governance1/10Upgrades1/10Checks passed3 of 7Findings1 Critical · 2 High · 1 Medium · 1 Info5
SummaryAI Copilot

The VisionToken contract is an upgradeable ERC-20 token utilizing OpenZeppelin's battle-tested libraries for core functionalities, access control, pausing, and UUPS upgradeability.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 98.7%
  • LP top3 unlocked holders = 100.0%
  • 1 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 50% (97.3% total → 58.5% effective; 32.6% in EOAs, 64.8% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 98.7% (independent LP — depth risk, pool = 67% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 67% of DEX liquidity)
  • 1 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
64.8%Contracts32.6%Wallets2.7%
64.8%Contracts32.6%Wallets
ContractsWalletsEveryone elseBubble area = share of supply
97.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking64.8%
  • Walletsanonymous holders, free to sell32.6%
  • Everyone elsethe rest of the supply2.7%
Effective concentrationwhat the score reads58.5%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$5.14M across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$3.42MShare of depth66.5%
Top-1 Unlocked Holder98.7%
Top-3 Unlocked100.0%
Unlocked LP held by
0xa1e2…58400xa072…e9000x1cf0…50df

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical2 High1 Medium1 Info
Critical

Centralized Control of Critical Roles

The VisionToken contract relies on several highly privileged roles: DEFAULT_ADMIN_ROLE (can grant/revoke any role), MINTER_ROLE (unlimited token minting), PAUSER_ROLE (can halt all transfers), and UPGRADER_ROLE (can change contract logic). All these roles are initially assigned in the initialize function. If the addresses assigned to these roles, particularly the roleAdmin for DEFAULT_ADMIN_ROLE, are single Externally Owned Accounts (EOAs), they represent single points of failure. A compromise of any of these keys could lead to complete system control, economic manipulation, or operational shutdown (7.3 Access Control, 7.8 Operations).C-01

Issue

The VisionToken contract relies on several highly privileged roles: DEFAULT_ADMIN_ROLE (can grant/revoke any role), MINTER_ROLE (unlimited token minting), PAUSER_ROLE (can halt all transfers), and UPGRADER_ROLE (can change contract logic). All these roles are initially assigned in the initialize function. If the addresses assigned to these roles, particularly the roleAdmin for DEFAULT_ADMIN_ROLE, are single Externally Owned Accounts (EOAs), they represent single points of failure. A compromise of any of these keys could lead to complete system control, economic manipulation, or operational shutdown (7.3 Access Control, 7.8 Operations).

Fix

Implement multi-signature wallets (e.g., Gnosis Safe) for all critical roles, especially DEFAULT_ADMIN_ROLE, MINTER_ROLE, and UPGRADER_ROLE. This distributes control and requires multiple approvals for sensitive actions, significantly reducing the risk of a single point of failure. For PAUSER_ROLE, a multi-sig is also recommended.

Status

Unresolved

High

Unlimited Minting Capability

The MINTER_ROLE has the ability to mint an arbitrary amount of tokens to any address via the mint function. This unlimited minting capability poses a significant economic risk (7.4 Economic). If the MINTER_ROLE is compromised or misused, it could lead to hyperinflation, devaluing the token for all holders and undermining the protocol's economic stability.H-01

Issue

The MINTER_ROLE has the ability to mint an arbitrary amount of tokens to any address via the mint function. This unlimited minting capability poses a significant economic risk (7.4 Economic). If the MINTER_ROLE is compromised or misused, it could lead to hyperinflation, devaluing the token for all holders and undermining the protocol's economic stability.

Fix

If unlimited minting is not strictly necessary for the protocol's design, consider implementing safeguards. This could include setting a maximum total supply, implementing a minting rate limit, or requiring a timelock for large minting operations. Ensure the MINTER_ROLE is controlled by a robust multi-signature wallet with strict governance procedures.

Status

Unresolved

High

Upgradeability Risk

The contract utilizes the UUPS proxy pattern, allowing its implementation logic to be upgraded by the UPGRADER_ROLE. While upgradeability offers flexibility for bug fixes and feature enhancements, it introduces inherent risk (7.7 Upgrades). A malicious or buggy upgrade could introduce new vulnerabilities, freeze user funds, or alter tokenomics, potentially leading to a complete system compromise. The UPGRADER_ROLE holds significant power over the contract's future behavior.H-02

Issue

The contract utilizes the UUPS proxy pattern, allowing its implementation logic to be upgraded by the UPGRADER_ROLE. While upgradeability offers flexibility for bug fixes and feature enhancements, it introduces inherent risk (7.7 Upgrades). A malicious or buggy upgrade could introduce new vulnerabilities, freeze user funds, or alter tokenomics, potentially leading to a complete system compromise. The UPGRADER_ROLE holds significant power over the contract's future behavior.

Fix

Ensure the UPGRADER_ROLE is controlled by a highly secure multi-signature wallet with a robust governance process. Implement a timelock for upgrade proposals to allow community review and reaction time before an upgrade is executed. Thoroughly audit and test all new implementation contracts before deployment to the production environment.

Status

Unresolved

Medium

Pausing Mechanism Centralization

The PAUSER_ROLE has the ability to pause and unpause all token transfers and approvals via the pause() and unpause() functions. While this feature can be valuable for emergency situations (e.g., mitigating an exploit), it also centralizes significant operational control (7.8 Operations). A malicious or compromised PAUSER_ROLE could halt legitimate user activity, disrupt liquidity, and cause market instability.M-01

Issue

The PAUSER_ROLE has the ability to pause and unpause all token transfers and approvals via the pause() and unpause() functions. While this feature can be valuable for emergency situations (e.g., mitigating an exploit), it also centralizes significant operational control (7.8 Operations). A malicious or compromised PAUSER_ROLE could halt legitimate user activity, disrupt liquidity, and cause market instability.

Fix

Control the PAUSER_ROLE with a multi-signature wallet to prevent a single point of failure. Clearly define and document the specific conditions under which pausing is permissible. Consider implementing a timelock for the unpause() function to prevent immediate re-enablement after a malicious pause, allowing time for intervention.

Status

Unresolved

Info

Lack of Time-locks for Critical Operations

The contract does not implement time-locks for critical operations such as contract upgrades, significant token minting, or changes to privileged roles. While the use of multi-signature wallets mitigates some risk, a time-lock would provide an additional layer of security by introducing a delay between the initiation and execution of a sensitive action (7.5 Governance, 7.8 Operations). This delay allows for community review, detection of malicious intent, and potential intervention.I-01

Issue

The contract does not implement time-locks for critical operations such as contract upgrades, significant token minting, or changes to privileged roles. While the use of multi-signature wallets mitigates some risk, a time-lock would provide an additional layer of security by introducing a delay between the initiation and execution of a sensitive action (7.5 Governance, 7.8 Operations). This delay allows for community review, detection of malicious intent, and potential intervention.

Fix

Consider implementing time-locks for all highly sensitive operations, including contract upgrades, large token mints, and changes to critical roles (e.g., DEFAULT_ADMIN_ROLE, MINTER_ROLE, UPGRADER_ROLE). This enhances transparency and provides a crucial window for the community or governance to react to potentially harmful actions.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The VisionToken contract is an upgradeable ERC-20 token utilizing OpenZeppelin's battle-tested libraries for core functionalities, access control, pausing, and UUPS upgradeability. The contract demonstrates good adherence to established patterns for upgradeable tokens and includes basic input validation. However, the design centralizes significant power in specific roles (minting, pausing, upgrading, and overall administration), which, if compromised or misused, could lead to severe economic or operational consequences. Recommendations focus on decentralizing control through multi-signature wallets and implementing time-locks for critical operations.

Technical3/10High risk

The contract leverages well-audited OpenZeppelin upgradeable libraries, enhancing code security and adherence to established patterns (7.2 Code Security). Input validations for zero amounts and addresses are correctly implemented, reducing common error vectors. However, the reliance on a single UPGRADER_ROLE for contract logic changes introduces a significant technical risk (7.7 Upgrades), as a compromised key could lead to arbitrary code execution. The _authorizeUpgrade function correctly restricts upgrade permissions to this role.

Governance1/10High risk

The contract implements a robust role-based access control system using OpenZeppelin's AccessControlUpgradeable (7.3 Access Control), defining distinct roles for administration, pausing, minting, and upgrading. However, this design centralizes significant power in specific roles, particularly the MINTER_ROLE which can mint unlimited tokens, posing a high economic risk (7.4 Economic) due to potential inflation. The PAUSER_ROLE also holds considerable power to halt all token transfers (7.8 Operations), which could disrupt liquidity.

Upgrades1/10High risk

The contract correctly utilizes the UUPS proxy pattern for upgradeability, allowing future enhancements and bug fixes (7.7 Upgrades). The _authorizeUpgrade function is properly secured by the UPGRADER_ROLE, ensuring only authorized entities can initiate upgrades. However, the inherent nature of upgradeability, coupled with the centralized control of the UPGRADER_ROLE, presents a high risk, as a compromised role could lead to malicious contract logic deployment without sufficient time for community review or intervention.

Final RecommendationWhat to do about this score

Prioritize the implementation of multi-signature wallets for all critical roles, especially the DEFAULT_ADMIN_ROLE, MINTER_ROLE, and UPGRADER_ROLE, to mitigate single points of failure and enhance security.

Establish clear, documented governance procedures for all privileged operations, including token minting, pausing, and contract upgrades. Consider implementing time-locks for sensitive actions to provide a window for review and reaction, enhancing overall protocol security and transparency.

Contract & Record

1 audit on record
TypeERC1967Proxy
NetworkEthereum
Token age1y
Contract0x699c…f753
Deployer0x85c5…a688
Proxy Upgrade Controls
Proxy TypeEip1967 Uups
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Vision security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 31, 202695Critical

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the VSN contract address?

The Vision (VSN) contract on Ethereum is 0x699ccf919c1dfdfa4c374292f42cadc9899bf753. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Vision a scam?

Quantum Audit's risk score for Vision is 95/100 (Critical risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is VSN liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $5.14M.

Who holds VSN?

As of Sep 4, 2026, the 10 largest holders own 97.3% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
tapEthereum94CriticalNEAREthereum96CriticalHumanityH · Ethereum97CriticalApple (Ondo Tokenized)AAPLON · Ethereum97CriticalPunkStrategyPNKSTR · Ethereum92CriticalusocksEthereum91Critical

Would You Like a More Detailed Audit of Vision?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page