Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Zama Safe?

ZAMAEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades3/10Checks passed2 of 5Findings1 Low · 3 Info4
SummaryAI Copilot

This audit focuses exclusively on the provided OpenZeppelin AccessControl.sol contract.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 70% (95.6% total → 80.0% effective; 69.6% in EOAs, 25.9% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
25.9%Contracts69.6%Wallets4.4%
25.9%Contracts69.6%Wallets
ContractsWalletsEveryone elseBubble area = share of supply
95.6%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking25.9%
  • Walletsanonymous holders, free to sell69.6%
  • Everyone elsethe rest of the supply4.4%
Effective concentrationwhat the score reads80.0%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$553.5K across 3 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$524.7KShare of depth94.8%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x11b6…92c40xcac5…24dc

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low3 Info
Low

Criticality of Proper Role Management

The overall security of any system utilizing AccessControl is highly dependent on the correct and secure management of roles (7.3 Access Control, 7.8 Operations). Misconfigurations, such as granting excessive privileges or failing to revoke roles from compromised accounts, can lead to unauthorized access to sensitive functions or assets.L-01

Issue

The overall security of any system utilizing AccessControl is highly dependent on the correct and secure management of roles (7.3 Access Control, 7.8 Operations). Misconfigurations, such as granting excessive privileges or failing to revoke roles from compromised accounts, can lead to unauthorized access to sensitive functions or assets.

Fix

Establish clear policies and procedures for role assignment, revocation, and administration. Regularly audit current role holders and their permissions. Adhere to the principle of least privilege, ensuring accounts only have the roles necessary for their intended functions.

Status

Unresolved

Info

DEFAULT_ADMIN_ROLE Self-Administration Requires Vigilance

The DEFAULT_ADMIN_ROLE is designed to be its own administrator. This means any account holding the DEFAULT_ADMIN_ROLE can grant or revoke this role from other accounts, as well as administer all other roles. While a standard OpenZeppelin design, it concentrates significant power (7.3 Access Control).I-01

Issue

The DEFAULT_ADMIN_ROLE is designed to be its own administrator. This means any account holding the DEFAULT_ADMIN_ROLE can grant or revoke this role from other accounts, as well as administer all other roles. While a standard OpenZeppelin design, it concentrates significant power (7.3 Access Control).

Fix

Implement robust operational security measures for accounts holding the DEFAULT_ADMIN_ROLE, such as multi-signature wallets, hardware security modules, or time-locks for critical operations. Consider using OpenZeppelin's AccessControlDefaultAdminRules for enhanced security around this role.

Status

Unresolved

Info

Abstract Nature and Integration Dependency

AccessControl is an abstract contract (7.1 Architecture) designed to be inherited by other contracts. Its security and functionality are fully realized only when correctly integrated into a concrete contract. The audit of this module alone does not cover potential vulnerabilities arising from its specific implementation within a larger system.I-02

Issue

AccessControl is an abstract contract (7.1 Architecture) designed to be inherited by other contracts. Its security and functionality are fully realized only when correctly integrated into a concrete contract. The audit of this module alone does not cover potential vulnerabilities arising from its specific implementation within a larger system.

Fix

Ensure that the inheriting contract correctly implements and utilizes the AccessControl functions. A comprehensive audit of the concrete contract that inherits AccessControl is recommended to assess the full security posture of the system.

Status

Unresolved

Info

No On-Chain Role Enumeration

This version of AccessControl (7.1 Architecture) does not provide functions to enumerate all accounts holding a specific role on-chain. Role membership can only be determined by parsing past RoleGranted and RoleRevoked events off-chain. For some applications, on-chain enumerability might be desired.I-03

Issue

This version of AccessControl (7.1 Architecture) does not provide functions to enumerate all accounts holding a specific role on-chain. Role membership can only be determined by parsing past RoleGranted and RoleRevoked events off-chain. For some applications, on-chain enumerability might be desired.

Fix

If on-chain enumeration of role members is a requirement, consider using OpenZeppelin's AccessControlEnumerable module instead, which provides this functionality.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit focuses exclusively on the provided OpenZeppelin AccessControl.sol contract. While the prefilled contract name indicated 'ZamaERC20', only the AccessControl source was available for review. The AccessControl module provides a robust, battle-tested role-based access control system. No critical or high-severity vulnerabilities were identified within this specific module. The primary considerations revolve around the secure implementation and diligent management of roles by any inheriting contracts.

Technical6/10Medium risk

The AccessControl contract (7.1 Architecture, 7.2 Code Security) is a well-designed and extensively audited OpenZeppelin module, providing a robust role-based access control system. It leverages custom errors for gas efficiency and adheres to ERC-165 for interface detection. The code is clear, modular, and follows established security patterns, with no identified reentrancy or integer overflow vulnerabilities. A key consideration (7.3 Access Control) is the management of the DEFAULT_ADMIN_ROLE, which is self-administering and requires careful handling to prevent unauthorized access.

Governance1/10High risk

The AccessControl module itself does not introduce direct economic or governance risks (7.4 Economic, 7.5 Governance). Its security implications are primarily derived from how it is integrated and managed within a larger protocol. The system's integrity relies on the secure assignment and revocation of roles, particularly the DEFAULT_ADMIN_ROLE, which can control all other roles. Proper operational procedures (7.8 Operations) for role management are essential to mitigate potential governance risks arising from compromised keys or misconfigurations.

Upgrades3/10High risk

The AccessControl contract is an abstract base component and is not inherently upgradeable (7.7 Upgrades). If a contract inheriting AccessControl is designed to be upgradeable (e.g., via a proxy pattern), careful consideration must be given to how roles and their states are managed across upgrades. Ensuring that role assignments and admin roles persist correctly and are not inadvertently altered during an upgrade is crucial for maintaining consistent access control.

Final RecommendationWhat to do about this score

For any contract inheriting AccessControl, prioritize robust key management for accounts holding administrative roles, especially the DEFAULT_ADMIN_ROLE.

Implement multi-signature wallets or time-locks for critical role-granting/revoking operations to enhance security. Regularly review and audit role assignments to ensure the principle of least privilege is maintained. Consider integrating AccessControlDefaultAdminRules for additional security measures around the DEFAULT_ADMIN_ROLE if the application's complexity and risk profile warrant it.

Contract & Record

1 audit on record
TypeToken
NetworkEthereum
Token age5mo
Contract0xa12c…f4f3
Deployer0x9cf3…4598
Badge for your website
Zama security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202668High
  2. Jul 23, 202646Medium
  3. Jul 23, 202666High
  4. Jul 22, 202648Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
REEthereum68HighUNICURVEEthereum68HighChainXCN · Ethereum68HighPhalaPHA · Ethereum68HighGram (prev. Toncoin)GRAM · Ethereum69HighDIATokenDIA · Ethereum67High

Would You Like a More Detailed Audit of Zama?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page