Quantum Audit Logo

Is wojak a Scam?

Honeypot, rug-pull and ownership checks

Is this your token? Publish your own audit on this page →

wojak WOJAK
0x8de3…31ef
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The Wojak Token contract is an ERC-20 token implementation with extensive owner-controlled features, including configurable transaction fees, maximum transaction/wallet limits, minting capabilities, and a liquidity generation mechanism. While leveraging OpenZeppelin's secure base contracts, the high degree of centralization introduces significant economic and operational risks. The owner possesses the ability to drastically alter tokenomics, potentially leading to a honeypot scenario or liquidity rug-pull. Technical aspects like unchecked external call return values and lack of slippage protection in swaps also present vulnerabilities.

1 Critical2 High2 Medium1 Low
i Our automated scanner reviewed wojak (WOJAK) on Ethereum. 5 of 5 security checks passed — see the full breakdown below.
Volume 24h
$217.2K
Liquidity
$1.02M
Price
$0.0000000637
Age
3mo
Top 10 Holders
40.5%

Security Findings

1 Crit2 High2 Med1 Low
Critical

Extreme Centralization and Honeypot Risk

C-01The contract grants the owner extensive control over critical token parameters, including the ability to set arbitrary transaction and wallet limits, adjust transfer fees (tax and liquidity fees) up to 100%, mint new tokens, pause trading, and exclude specific addresses from all tokenomics. This level of control allows the owner to manipulate the token's economy at will, potentially creating a honeypot scenario where users can buy but are prevented from selling or face prohibitive fees. This impacts 7.3 Access Control, 7.4 Economic, 7.5 Governance, and 7.8 Operations.
IssueThe contract grants the owner extensive control over critical token parameters, including the ability to set arbitrary transaction and wallet limits, adjust transfer fees (tax and liquidity fees) up to 100%, mint new tokens, pause trading, and exclude specific addresses from all tokenomics. This level of control allows the owner to manipulate the token's economy at will, potentially creating a honeypot scenario where users can buy but are prevented from selling or face prohibitive fees. This impacts 7.3 Access Control, 7.4 Economic, 7.5 Governance, and 7.8 Operations.
FixImplement a multi-signature wallet for ownership, introduce time-locks for critical parameter changes, or decentralize control through a governance mechanism. Clearly communicate the extent of owner privileges to users and consider capping fees and limits at reasonable, non-exploitable levels.
StatusUnresolved
High

Lack of Minimum Amount Out in Swaps

H-01The `_swapAndLiquify` function, as well as `swapTokensForEth` and `addLiquidity`, use Uniswap's `swapExactTokensForETHSupportingFeeOnTransferTokens` without specifying a `minAmountOut` parameter. This omission exposes the swap operation to sandwich attacks and significant slippage, especially during periods of high volatility or low liquidity, potentially leading to a loss of value for the tokens being swapped. This impacts 7.2 Code Security and 7.4 Economic.
IssueThe `_swapAndLiquify` function, as well as `swapTokensForEth` and `addLiquidity`, use Uniswap's `swapExactTokensForETHSupportingFeeOnTransferTokens` without specifying a `minAmountOut` parameter. This omission exposes the swap operation to sandwich attacks and significant slippage, especially during periods of high volatility or low liquidity, potentially leading to a loss of value for the tokens being swapped. This impacts 7.2 Code Security and 7.4 Economic.
FixImplement a `minAmountOut` parameter in all swap functions to protect against excessive slippage and front-running. This value should ideally be calculated based on current market conditions or a user-defined tolerance.
StatusUnresolved
High

Owner Can Drain Liquidity Pool Tokens

H-02The `_swapAndLiquify` function adds liquidity to the Uniswap pair, and the resulting LP tokens are sent to the contract itself. The `rescueERC20` function, callable by the owner, allows the owner to withdraw any ERC20 tokens held by the contract. This means the owner can withdraw the LP tokens, effectively removing liquidity from the pool and potentially rug-pulling investors. This impacts 7.3 Access Control and 7.4 Economic.
IssueThe `_swapAndLiquify` function adds liquidity to the Uniswap pair, and the resulting LP tokens are sent to the contract itself. The `rescueERC20` function, callable by the owner, allows the owner to withdraw any ERC20 tokens held by the contract. This means the owner can withdraw the LP tokens, effectively removing liquidity from the pool and potentially rug-pulling investors. This impacts 7.3 Access Control and 7.4 Economic.
FixImplement a mechanism to burn LP tokens or send them to a locked, unspendable address (e.g., the zero address) to ensure liquidity remains permanently locked. If LP tokens are intended to be managed, a transparent and secure governance or time-lock mechanism should be in place for their withdrawal.
StatusUnresolved
Medium

Configurable Router and Pair Addresses

M-01The owner can update the `uniswapV2Router` and `uniswapV2Pair` addresses via `updateUniswapV2Router` and `updateUniswapV2Pair` functions. While this offers flexibility, a malicious or compromised owner could redirect token swaps and liquidity additions to a fraudulent router or pair contract, leading to loss of funds or manipulation of the token's market. This impacts 7.3 Access Control and 7.6 External.
IssueThe owner can update the `uniswapV2Router` and `uniswapV2Pair` addresses via `updateUniswapV2Router` and `updateUniswapV2Pair` functions. While this offers flexibility, a malicious or compromised owner could redirect token swaps and liquidity additions to a fraudulent router or pair contract, leading to loss of funds or manipulation of the token's market. This impacts 7.3 Access Control and 7.6 External.
FixConsider making these addresses immutable after deployment or implementing a time-lock for changes to critical external contract addresses. If flexibility is required, ensure robust monitoring and transparency around such changes.
StatusUnresolved
Medium

Unchecked Return Values of External Calls

M-02The `_swapAndLiquify` and `swapTokensForEth` functions call `IERC20(token).approve(address(this), type(uint256).max)` without checking the boolean return value. While many ERC20 tokens revert on failure, some older or non-standard implementations might return `false` instead. Ignoring this return value could lead to a false assumption that the approval succeeded, potentially causing subsequent operations to fail unexpectedly. This impacts 7.2 Code Security.
IssueThe `_swapAndLiquify` and `swapTokensForEth` functions call `IERC20(token).approve(address(this), type(uint256).max)` without checking the boolean return value. While many ERC20 tokens revert on failure, some older or non-standard implementations might return `false` instead. Ignoring this return value could lead to a false assumption that the approval succeeded, potentially causing subsequent operations to fail unexpectedly. This impacts 7.2 Code Security.
FixAlways check the boolean return value of external ERC20 calls, especially `transfer`, `transferFrom`, and `approve`, to ensure the operation was successful. For example, `require(IERC20(token).approve(...), "ERC20: approve failed");`.
StatusUnresolved
Low

Lack of Events for Critical Parameter Changes

L-01Several owner-controlled functions that modify critical parameters, such as `setMaxTxAmount`, `setMaxWalletAmount`, `setSwapAndLiquifyThreshold`, `setNumTokensSellToAddToLiquidity`, `setRouterAddress`, `setPairAddress`, `setTradingOpen`, `excludeFromMaxTx`, `includeInMaxTx`, `excludeFromMaxWallet`, `includeInMaxWallet`, `excludeFromSwap`, `includeInSwap`, do not emit events. This makes it difficult for off-chain monitoring tools and users to track changes to the token's behavior and parameters, reducing transparency. This impacts 7.8 Operations.
IssueSeveral owner-controlled functions that modify critical parameters, such as `setMaxTxAmount`, `setMaxWalletAmount`, `setSwapAndLiquifyThreshold`, `setNumTokensSellToAddToLiquidity`, `setRouterAddress`, `setPairAddress`, `setTradingOpen`, `excludeFromMaxTx`, `includeInMaxTx`, `excludeFromMaxWallet`, `includeInMaxWallet`, `excludeFromSwap`, `includeInSwap`, do not emit events. This makes it difficult for off-chain monitoring tools and users to track changes to the token's behavior and parameters, reducing transparency. This impacts 7.8 Operations.
FixEmit explicit events for all functions that modify critical contract state variables. This enhances transparency and allows for easier monitoring and auditing of contract behavior.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The contract utilizes OpenZeppelin's battle-tested ERC20 and Ownable implementations, providing a solid foundation (7.1 Architecture, 7.2 Code Security). A reentrancy guard (`inSwapAndLiquify`) is correctly implemented for the swap and liquify mechanism, mitigating a common vulnerability (7.2 Code Security). However, the contract lacks minimum amount out parameters in its swap functions, exposing users to high slippage and front-running (7.2 Code Security). Additionally, some external ERC20 calls do not check their return values, which could lead to unexpected behavior (7.2 Code Security).

GovernanceMedium6/10

The contract exhibits extreme centralization, with the owner having unilateral control over critical token parameters (7.3 Access Control, 7.5 Governance). The owner can set arbitrary transaction fees (tax and liquidity fees up to 100%), define maximum transaction and wallet amounts, mint new tokens, pause trading, and exclude any address from all tokenomics (7.4 Economic). This level of control creates a significant honeypot risk, where the owner could prevent users from selling or drain liquidity (7.4 Economic). The owner can also rescue LP tokens from the contract, enabling a rug-pull (7.4 Economic).

UpgradesLow9/10

The contract is not designed with an upgrade mechanism (7.7 Upgrades). This means its logic is immutable after deployment, eliminating upgrade-related risks but also preventing future bug fixes or feature enhancements without a new deployment.

Security Checklist

5/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionPass
Liquidity LockedPass
Not a ProxyPass

Holder Composition

40.5% in top 10
35.5% in wallets5.1% in contracts
Effective Concentration37.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.02M across 2 pairs
Uniswap v2WETHanalysed$1.02M99.8%Uniswap v3WETH$1.9K0.2%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

LP Burned100.0% · ≈ permanent lock
LP Locked100.0% · Null Address

Key Addresses

5 addresses
Deployer
0x93aa…6362
Unlocked LP Held By
0xdbbf…b03d0xac74…d8a30xeb0c…493f0x1f2f…f387

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

5 factors
  • Top-10 concentration > 30% (40.5% total → 37.5% effective; 35.5% in EOAs, 5.1% in contracts — moderate)
  • 1 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Balancer (BAL)Medium RiskCateMedium RiskApeCoin (APE)Medium Risk01Medium RiskI love puppies (PUPPIES)Medium RiskAliensMedium Risk

Would You Like a More Detailed Audit of wojak?

Paste the contract address into our AI-powered scanner for a deeper real-time report — free, with every scoring factor shown.

Get Detailed Audit