How to read our audit instead of trusting the badge

An audit badge tells you a report exists. It does not tell you what the report said. Ours returned a risk score of 51 out of 100 and two open high-severity findings — both still listed on the front page. Here is how to read it yourself.

What was scanned

The review covers the deployed YACOIN contract on Danny Chain, compiled with solc v0.8.19+commit.7dd6d404, at address 0xB8Ce109cf97b614b562A5E274C8Df22526f190A9.

Severity is a scale, not a verdict

The scan produced 21 findings: 2 high, 3 low, 6 informational, and 10 gas. Only the first group changes who can move your money. Grading reflects what an attacker could do, not how hard the fix is.

The two high findings, in plain terms

• Unprotected privileged function burn — YACOIN.sol:591. The function is externally callable and changes state, but carries no access-control modifier and no visible msg.sender check. Any account can call it. Flagged under SWC-105 and OWASP SC01 (Access Control).
• Unprotected privileged function burnFrom — YACOIN.sol:595. The same pattern, on the paired function.

The recommended fix in both cases is the ordinary one: restrict the function with an access-control modifier such as onlyOwner, or OpenZeppelin's AccessControl roles.

What the scan cleared

It is as useful to know what came back clean. Reentrancy (SWC-107), tx.origin authorisation (SWC-115), unchecked call return values (SWC-104), delegatecall to an untrusted callee (SWC-112), unprotected selfdestruct (SWC-106), weak randomness, block-value time proxies, floating pragma, and gas-based denial of service all returned no issues.

The three OWASP categories that were flagged are SC01 Access Control (2), SC04 Input Validation (2), and SC08 Integer Overflow & Underflow (4).

The findings that are not emergencies

• Low (3). A parameter named _owner shadows a state variable at line 566, and two constructor/ownership paths lack a zero-address check.
• Informational (6). Four unchecked{} blocks, plus transferOwnership and _update changing state without emitting an event — which makes off-chain tracking harder without making funds less safe.
• Gas (10). Ten public functions that could be declared external, including transfer, approve, and balanceOf. Cheaper to run, not safer.

What an audit does not cover

• Code deployed after the review. Any material change means a re-audit, or the report describes something other than what is running.
• Economic design. A contract can be flawless and the tokenomics still unsustainable.
• Key management. The report reviews the contract, not who holds the admin keys.
• Business logic. This run was static analysis; the report itself notes that AI analysis would add deeper business-logic and economic-attack coverage.

Verify it independently

Open the EVMSmart report and read each finding with its code snippet and line number. Then open the same address on the Danny Explorer and compare it against the deployed contract. The token page also shows the live figures — 9,065 holders and 14,736 transfers — so no number here has to be taken on faith.