Early-stage security check — honeypot & rug-pull analysis
BNB ChainThe contract is a standard ERC-20 token with custom fee exclusion logic.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 21, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are locked or burned.
0x0ed9…97060xd399…68caNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The _executeSwapAndLiquify function allows the contract to move tokens from any address that has approved the contract, potentially draining user balances.
Restrict the function to only move tokens owned by the contract itself.
Unresolved
Presents itself as Zcash (ZEC), but CoinGecko lists no Zcash contract on bsc at all (CoinGecko). Holders who think they own the real asset own this contract instead; it has none of the real asset's backing, liquidity or redemption.
Do not buy, hold or accept this token as the asset it names. Verify any token address against the issuer's official site.
Acknowledged
The _executeSwapAndLiquify function ignores the return value of ERC-20 transfers, which may fail silently and lead to inconsistent state.
Use OpenZeppelin's SafeERC20 library to ensure all transfers are successful.
Unresolved
The contract can receive ETH via the receive function but lacks any mechanism to withdraw or utilize these funds, causing them to be permanently locked.
Implement a withdrawal function restricted to a secure address or remove the receive function.
Unresolved
Calculations in _executeSwapAndLiquify and _transfer perform division before multiplication, leading to precision loss.
Perform all multiplications before divisions to maintain precision.
Unresolved
The ten largest holders own 66.6% of supply. Of that, 65.9% burned, 0.3% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 0.0% in wallets, 0.3% in other contracts. 19,248 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
97.4% of the pool's LP is burned or time-locked. 97.4% is locked in PinkLock02 until 11 Nov 2026 (20 days). Until then nobody — the project included — can withdraw it unless the locker contract itself is flawed; after that date the lock's owner can. That date is close: treat it as short-term protection. 2.6% is held, unlocked, by 2 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
Liquidity $390K (DexScreener, all pools). 24h trading volume $10.1M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token presenting itself under the name or ticker of an established asset without being that asset's contract. Its only reason to borrow that identity is to be mistaken for it. Scored as an imitation (see the identity finding). Basis: behaves as: project token. Tokenomics — Supply: mint capability could not be read. Control: nobody (ownership renounced). Code: not upgradeable (no proxy). Fees: 3.9% on buy, 3.9% on sell. Market: $390K of DEX liquidity across 1 pools. Launch: under a day of market history.
Do not treat this token as the asset it names. Use only the official contract address published by that asset's issuer.
Acknowledged
The token's oldest DEX pool is less than a day old. Age is not part of the risk score — a new token is not a risky one by default — but a short history means fewer trades and holder changes behind the facts in this report.
Re-check ownership, liquidity and holder distribution as the token matures; those are the facts that move early.
Acknowledged
The contract is a standard ERC-20 token with custom fee exclusion logic. Ownership has been renounced, meaning privileged functions are now permanently disabled. However, the contract contains critical logic flaws in its internal swap and liquidity management functions that pose significant risks to token holders.
The architecture follows standard ERC-20 patterns with added fee-on-transfer logic. 7.1 Architecture is simple but flawed in its liquidity execution. 7.2 Code Security is compromised by unchecked return values and improper arithmetic ordering. 7.3 Access Control is currently locked due to renounced ownership, preventing further administrative changes.
7.4 Economic and 7.5 Governance are effectively neutralized as the contract owner has renounced control. No further changes to fee exclusions or ownership can be made. The economic model relies on internal swaps which are currently broken due to technical implementation errors.
7.7 Upgrades are not supported as this is a standard non-proxy contract. The logic is immutable. 7.8 Operations are limited to standard token transfers and the broken internal swap mechanism.
The contract is currently unsafe for use due to critical vulnerabilities in the internal swap logic.
Since ownership is renounced, the contract cannot be patched or upgraded to fix these issues. Users should avoid interacting with any functions that trigger the internal swap mechanism. Given the immutability of the contract, the current deployment should be considered deprecated and replaced with a new version that includes proper return value checks and secure arithmetic.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Zcash Token (ZEC) contract on BNB Chain is 0x77a78c698b8b42d1d956d373b37be45d5fdfaca3. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Zcash Token is 99/100 (Critical risk) as of Oct 21, 2026, computed by a deterministic function from on-chain facts — Contract verified: Not verified; Ownership: Renounced; Liquidity lock: Locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 3.9% / 3.9%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Locked (as of Oct 21, 2026). Total DEX liquidity: $389.6K.
As of Oct 21, 2026, the 10 largest holders own 66.6% of the supply across 19,248 holders. The Holders section on this page shows who they are by holder type.
This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.
Get Detailed Audit Is this your token? Publish your own audit on this page
