Quantum Audit Logo

Is Zest Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Zest ZEST
0x5506…54a1
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The ZestToken contract is a standard ERC20 token implementation, inheriting from well-audited OpenZeppelin contracts. It includes ERC20Permit functionality for gasless approvals. The contract exhibits a low overall risk profile due to its simplicity, reliance on battle-tested libraries, and lack of complex external interactions or upgradeability features.

1 Low2 Informational
Volume 24h
$96.9K
Liquidity
$10.5K
Price
$0.1544
Token Age
2mo
Top 10 Holders
100.0%

Security Findings

1 Low2 Info
Low

Front-running Risk in ERC20Permit Function

L-01The `permit` function, part of the ERC20Permit standard, allows for gasless approvals by signing a message off-chain. However, transactions calling `permit` are susceptible to front-running. A malicious actor observing a `permit` transaction in the mempool could submit their own transaction with a higher gas price, potentially causing the original transaction to fail or be executed in an undesirable order, especially if the `deadline` is far in the future. This is an inherent characteristic of the EIP-2612 standard and not a flaw in the contract's implementation.
IssueThe `permit` function, part of the ERC20Permit standard, allows for gasless approvals by signing a message off-chain. However, transactions calling `permit` are susceptible to front-running. A malicious actor observing a `permit` transaction in the mempool could submit their own transaction with a higher gas price, potentially causing the original transaction to fail or be executed in an undesirable order, especially if the `deadline` is far in the future. This is an inherent characteristic of the EIP-2612 standard and not a flaw in the contract's implementation.
FixUsers should be advised to set a reasonable and short `deadline` for `permit` signatures to minimize the window for front-running. While the contract implementation is correct, educating users on this risk is important for safe interaction.
StatusUnresolved
Info

Reliance on OpenZeppelin Contracts

I-01The ZestToken contract heavily relies on OpenZeppelin's battle-tested ERC20 and ERC20Permit implementations. This significantly reduces the risk of common vulnerabilities and ensures adherence to established standards. While OpenZeppelin contracts are highly audited, any future vulnerabilities discovered in these libraries could potentially affect ZestToken.
IssueThe ZestToken contract heavily relies on OpenZeppelin's battle-tested ERC20 and ERC20Permit implementations. This significantly reduces the risk of common vulnerabilities and ensures adherence to established standards. While OpenZeppelin contracts are highly audited, any future vulnerabilities discovered in these libraries could potentially affect ZestToken.
FixContinue to monitor OpenZeppelin's security advisories and updates. No direct action is required as this is a standard and recommended practice.
StatusUnresolved
Info

Fixed Total Supply and Initial Distribution

I-02The ZestToken contract mints a fixed total supply of 1,000,000,000 ZEST tokens (with 18 decimals) to the `msg.sender` (deployer) during construction. There are no further minting or burning functionalities available to any address after deployment. This establishes a fixed supply token where the initial distribution is entirely controlled by the deployer.
IssueThe ZestToken contract mints a fixed total supply of 1,000,000,000 ZEST tokens (with 18 decimals) to the `msg.sender` (deployer) during construction. There are no further minting or burning functionalities available to any address after deployment. This establishes a fixed supply token where the initial distribution is entirely controlled by the deployer.
FixEnsure that the deployer address is a secure, controlled entity (e.g., a multi-signature wallet) to manage the initial token supply effectively and securely. This is a design choice and not a vulnerability, but transparency regarding the initial distribution is crucial for token holders.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The ZestToken contract is built upon the robust and extensively audited OpenZeppelin ERC20 and ERC20Permit libraries, ensuring a high degree of code security and adherence to ERC standards (7.2 Code Security). The use of Solidity `^0.8.24` incorporates modern language features and safety checks. The architecture (7.1 Architecture) is straightforward, implementing a standard token with permit functionality. A minor technical consideration is the inherent front-running risk associated with the `permit` function (7.2 Code Security), which is a characteristic of the EIP-2612 standard rather than an implementation flaw.

GovernanceHigh1/10

The ZestToken contract is a simple, non-governable ERC20 token (7.5 Governance). Its economic model (7.4 Economic) involves a fixed total supply minted entirely to the deployer at creation, with no further minting or burning mechanisms controlled by external parties. There are no complex economic incentives or external dependencies (7.6 External) that could introduce economic vulnerabilities. Access control (7.3 Access Control) is limited to standard ERC20 operations, with no privileged roles beyond the initial mint.

UpgradesMedium5/10

The ZestToken contract is not designed to be upgradeable (7.7 Upgrades), which simplifies its architecture and eliminates the risks associated with proxy patterns, upgradeability mechanisms, and potential upgrade path vulnerabilities. This design choice provides certainty regarding the contract's immutable logic post-deployment, removing a common source of security concerns.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

100.0% in top 10
0.0% in wallets100.0% in contracts
Effective Concentration40.0%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$11.8K across 5 pairs
UniswapUSDTanalysed$10.5K89.2%Pancakeswap v3USDT$9738.3%UniswapUSDT$2492.1%UniswapEV$440.4%Pancakeswap v2JELLY$60.1%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

Key Addresses

1 addresses
Deployer
0x3a6d…f390

What Raised This Score

5 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 30% (100.0% total → 40.0% effective; 0.0% in EOAs, 100.0% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • Liquidity < $50k ($11,779 across 5 pairs — thin market)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
MetaSoilVerseProtocol (MSVP)Medium RiskSOON Token (SOON)Medium RiskBaby Doge Coin (BABYDOGE)Medium RiskMindNetwork FHE Token (FHE)Medium RiskGUAMedium RiskOrochi Network Token (ON)Medium Risk

Would You Like a More Detailed Audit of Zest?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit