Quantum Audit Logo

Is Zama Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Zama ZAMA
0xa12c…f4f3
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

This audit focuses exclusively on the provided OpenZeppelin `AccessControl.sol` contract. While the prefilled contract name indicated 'ZamaERC20', only the `AccessControl` source was available for review. The `AccessControl` module provides a robust, battle-tested role-based access control system. No critical or high-severity vulnerabilities were identified within this specific module. The primary considerations revolve around the secure implementation and diligent management of roles by any inheriting contracts.

1 Low3 Informational
Volume 24h
$759.1K
Liquidity
$524.7K
Price
$0.0545
Token Age
5mo
Top 10 Holders
95.6%

Security Findings

1 Low3 Info
Low

Criticality of Proper Role Management

L-01The overall security of any system utilizing `AccessControl` is highly dependent on the correct and secure management of roles (7.3 Access Control, 7.8 Operations). Misconfigurations, such as granting excessive privileges or failing to revoke roles from compromised accounts, can lead to unauthorized access to sensitive functions or assets.
IssueThe overall security of any system utilizing `AccessControl` is highly dependent on the correct and secure management of roles (7.3 Access Control, 7.8 Operations). Misconfigurations, such as granting excessive privileges or failing to revoke roles from compromised accounts, can lead to unauthorized access to sensitive functions or assets.
FixEstablish clear policies and procedures for role assignment, revocation, and administration. Regularly audit current role holders and their permissions. Adhere to the principle of least privilege, ensuring accounts only have the roles necessary for their intended functions.
StatusUnresolved
Info

`DEFAULT_ADMIN_ROLE` Self-Administration Requires Vigilance

I-01The `DEFAULT_ADMIN_ROLE` is designed to be its own administrator. This means any account holding the `DEFAULT_ADMIN_ROLE` can grant or revoke this role from other accounts, as well as administer all other roles. While a standard OpenZeppelin design, it concentrates significant power (7.3 Access Control).
IssueThe `DEFAULT_ADMIN_ROLE` is designed to be its own administrator. This means any account holding the `DEFAULT_ADMIN_ROLE` can grant or revoke this role from other accounts, as well as administer all other roles. While a standard OpenZeppelin design, it concentrates significant power (7.3 Access Control).
FixImplement robust operational security measures for accounts holding the `DEFAULT_ADMIN_ROLE`, such as multi-signature wallets, hardware security modules, or time-locks for critical operations. Consider using OpenZeppelin's `AccessControlDefaultAdminRules` for enhanced security around this role.
StatusUnresolved
Info

Abstract Nature and Integration Dependency

I-02`AccessControl` is an abstract contract (7.1 Architecture) designed to be inherited by other contracts. Its security and functionality are fully realized only when correctly integrated into a concrete contract. The audit of this module alone does not cover potential vulnerabilities arising from its specific implementation within a larger system.
Issue`AccessControl` is an abstract contract (7.1 Architecture) designed to be inherited by other contracts. Its security and functionality are fully realized only when correctly integrated into a concrete contract. The audit of this module alone does not cover potential vulnerabilities arising from its specific implementation within a larger system.
FixEnsure that the inheriting contract correctly implements and utilizes the `AccessControl` functions. A comprehensive audit of the concrete contract that inherits `AccessControl` is recommended to assess the full security posture of the system.
StatusUnresolved
Info

No On-Chain Role Enumeration

I-03This version of `AccessControl` (7.1 Architecture) does not provide functions to enumerate all accounts holding a specific role on-chain. Role membership can only be determined by parsing past `RoleGranted` and `RoleRevoked` events off-chain. For some applications, on-chain enumerability might be desired.
IssueThis version of `AccessControl` (7.1 Architecture) does not provide functions to enumerate all accounts holding a specific role on-chain. Role membership can only be determined by parsing past `RoleGranted` and `RoleRevoked` events off-chain. For some applications, on-chain enumerability might be desired.
FixIf on-chain enumeration of role members is a requirement, consider using OpenZeppelin's `AccessControlEnumerable` module instead, which provides this functionality.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The `AccessControl` contract (7.1 Architecture, 7.2 Code Security) is a well-designed and extensively audited OpenZeppelin module, providing a robust role-based access control system. It leverages custom errors for gas efficiency and adheres to ERC-165 for interface detection. The code is clear, modular, and follows established security patterns, with no identified reentrancy or integer overflow vulnerabilities. A key consideration (7.3 Access Control) is the management of the `DEFAULT_ADMIN_ROLE`, which is self-administering and requires careful handling to prevent unauthorized access.

GovernanceHigh1/10

The `AccessControl` module itself does not introduce direct economic or governance risks (7.4 Economic, 7.5 Governance). Its security implications are primarily derived from how it is integrated and managed within a larger protocol. The system's integrity relies on the secure assignment and revocation of roles, particularly the `DEFAULT_ADMIN_ROLE`, which can control all other roles. Proper operational procedures (7.8 Operations) for role management are essential to mitigate potential governance risks arising from compromised keys or misconfigurations.

UpgradesHigh3/10

The `AccessControl` contract is an abstract base component and is not inherently upgradeable (7.7 Upgrades). If a contract inheriting `AccessControl` is designed to be upgradeable (e.g., via a proxy pattern), careful consideration must be given to how roles and their states are managed across upgrades. Ensuring that role assignments and admin roles persist correctly and are not inadvertently altered during an upgrade is crucial for maintaining consistent access control.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass

Holder Composition

95.6% in top 10
69.6% in wallets25.9% in contracts
Effective Concentration80.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$553.5K across 3 pairs
Uniswap v3USDTanalysed$524.7K94.8%Uniswap v3USDT$20.8K3.7%SupernovaUSDT$8.1K1.5%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0x9cf3…4598
Unlocked LP Held By
0x11b6…92c40xcac5…24dc

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

7 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70% (95.6% total → 80.0% effective; 69.6% in EOAs, 25.9% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
REHigh RiskUNICURVEHigh RiskChain (XCN)High RiskGram (prev. Toncoin) (GRAM)High RiskDIAToken (DIA)High RiskTERAFABHigh Risk

Would You Like a More Detailed Audit of Zama?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit