On-chain security analysis — is it a scam or legit?
BNB ChainThe ZestToken contract is a standard ERC20 token implementation, inheriting from well-audited OpenZeppelin contracts.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
Whether the LP tokens are locked could not be determined.
permit function, part of the ERC20Permit standard, allows for gasless approvals by signing a message off-chain. However, transactions calling permit are susceptible to front-running. A malicious actor observing a permit transaction in the mempool could submit their own transaction with a higher gas price, potentially causing the original transaction to fail or be executed in an undesirable order, especially if the deadline is far in the future. This is an inherent characteristic of the EIP-2612 standard and not a flaw in the contract's implementation.L-01The permit function, part of the ERC20Permit standard, allows for gasless approvals by signing a message off-chain. However, transactions calling permit are susceptible to front-running. A malicious actor observing a permit transaction in the mempool could submit their own transaction with a higher gas price, potentially causing the original transaction to fail or be executed in an undesirable order, especially if the deadline is far in the future. This is an inherent characteristic of the EIP-2612 standard and not a flaw in the contract's implementation.
Users should be advised to set a reasonable and short deadline for permit signatures to minimize the window for front-running. While the contract implementation is correct, educating users on this risk is important for safe interaction.
Unresolved
The ZestToken contract heavily relies on OpenZeppelin's battle-tested ERC20 and ERC20Permit implementations. This significantly reduces the risk of common vulnerabilities and ensures adherence to established standards. While OpenZeppelin contracts are highly audited, any future vulnerabilities discovered in these libraries could potentially affect ZestToken.
Continue to monitor OpenZeppelin's security advisories and updates. No direct action is required as this is a standard and recommended practice.
Unresolved
msg.sender (deployer) during construction. There are no further minting or burning functionalities available to any address after deployment. This establishes a fixed supply token where the initial distribution is entirely controlled by the deployer.I-02The ZestToken contract mints a fixed total supply of 1,000,000,000 ZEST tokens (with 18 decimals) to the msg.sender (deployer) during construction. There are no further minting or burning functionalities available to any address after deployment. This establishes a fixed supply token where the initial distribution is entirely controlled by the deployer.
Ensure that the deployer address is a secure, controlled entity (e.g., a multi-signature wallet) to manage the initial token supply effectively and securely. This is a design choice and not a vulnerability, but transparency regarding the initial distribution is crucial for token holders.
Unresolved
The ZestToken contract is a standard ERC20 token implementation, inheriting from well-audited OpenZeppelin contracts. It includes ERC20Permit functionality for gasless approvals. The contract exhibits a low overall risk profile due to its simplicity, reliance on battle-tested libraries, and lack of complex external interactions or upgradeability features.
The ZestToken contract is built upon the robust and extensively audited OpenZeppelin ERC20 and ERC20Permit libraries, ensuring a high degree of code security and adherence to ERC standards (7.2 Code Security). The use of Solidity ^0.8.24 incorporates modern language features and safety checks. The architecture (7.1 Architecture) is straightforward, implementing a standard token with permit functionality. A minor technical consideration is the inherent front-running risk associated with the permit function (7.2 Code Security), which is a characteristic of the EIP-2612 standard rather than an implementation flaw.
The ZestToken contract is a simple, non-governable ERC20 token (7.5 Governance). Its economic model (7.4 Economic) involves a fixed total supply minted entirely to the deployer at creation, with no further minting or burning mechanisms controlled by external parties. There are no complex economic incentives or external dependencies (7.6 External) that could introduce economic vulnerabilities. Access control (7.3 Access Control) is limited to standard ERC20 operations, with no privileged roles beyond the initial mint.
The ZestToken contract is not designed to be upgradeable (7.7 Upgrades), which simplifies its architecture and eliminates the risks associated with proxy patterns, upgradeability mechanisms, and potential upgrade path vulnerabilities. This design choice provides certainty regarding the contract's immutable logic post-deployment, removing a common source of security concerns.
The ZestToken contract is a well-implemented and low-risk ERC20 token.
Users should be aware of the general front-running risks associated with the permit function, which is inherent to the EIP-2612 standard. For future development, consider implementing a multi-signature wallet for the initial deployer address if it holds a significant portion of the token supply, to enhance operational security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Zest contract on BNB Chain is 0x5506599c722389a60580b5213ea1da60d64754a1. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Zest is 40/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
As of Sep 4, 2026, the 10 largest holders own 100.0% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
