Most security tools ask for trust before they give evidence. A score appears, a badge turns green or red, and the reasoning stays inside the vendor. Quantum Audit is built the other way round: the reasoning is the product, and the score is what falls out of it.
This page is the plain description of the platform. What it does, how a result is produced, what it refuses to claim, and where the work can be checked by anyone who wants to check it.
What Quantum Audit Is
Quantum Audit is an automated smart contract security analysis platform for Web3.
It reads verified contract source code, cross-references on-chain facts from several independent registries, and produces a security report with severity-graded findings and a numeric risk score. The analysis runs on demand against any contract address, and a growing record of completed analyses is published as a public dashboard.
Two properties separate it from most of what sits nearby.
The first is that the risk score is not written by the AI. A language model reads the source and surfaces findings; a separate deterministic function converts collected facts into a number. The same contract, given the same on-chain state, produces the same score on every run. This is not a stylistic preference. A score that a model invents is a score nobody can reproduce, contest, or audit.
The second is that the reasoning ships with the result. Every dashboard entry carries a section called "What Raised This Score" listing the specific signals that fired for that specific token, and links to a published methodology explaining how the scoring system works in general. A reader who disagrees with a verdict can trace it to the facts that produced it.
Who Runs It
Quantum Audit is an independent project, not an audit firm. There is no partner track, no engagement that begins with a scoping call, and no floor of reviewers billing by the hour. That is a deliberate boundary rather than a stage on the way to becoming one, and most of what the platform looks like follows from it.
An independent project cannot out-staff a firm, so it does not try to. What it can do instead is make the method reproducible and publish it, so the output can be checked without anyone's permission. Every decision described on this page traces back to that constraint: a number nobody else can reproduce is worth only as much as the brand asserting it, and an unpublished method is a request for trust rather than a reason for it.
The commitment that matters most is the one about money.
The score is never for sale. There is no paid placement on the dashboard, no paid removal, no boosted or featured slot, and no mechanism by which paying changes a score or the way it is presented. What can be bought is the audit itself: real analysis, a real re-check against current on-chain state. What cannot be bought is the verdict that comes out of it, or a position in any ranking that is not a plain tally of work actually performed.
This is not a courtesy, it is the product. A security record that can be paid into is not a security record. A founder publishing their own audit is only telling a stranger something useful if that stranger knows the result could not have been purchased.
Revenue comes from the audits themselves: a free monthly allowance, and paid capacity beyond it for anyone who needs to run more than that.
The Problem It Exists For
A person about to interact with a token has a narrow, practical question: can the contract take my money, and if so, how.
The existing answers are uncomfortable. A manual audit from an established firm is thorough, takes weeks, and costs more than most projects raise. Free scanners return a verdict in seconds but match patterns against on-chain bytecode without reading the contract, and rarely explain what drove the answer. Between "weeks and five figures" and "a green checkmark from a black box" there is a large gap, and most tokens live in it.
Quantum Audit is built for that gap: source-code-aware analysis, delivered in under a minute, with the arithmetic behind the verdict published rather than implied.
How an Audit Is Produced
An audit is a pipeline, and each stage leaves a trace in the final report.
Facts are collected first. Verified contract source is retrieved through Etherscan. Security registries supply flags such as honeypot behaviour, mint capability and transfer taxes. Market data supplies liquidity depth, pair age and volume. Holder distribution supplies the shape of the supply curve. Chain-native RPC supplies mint and freeze authority state on Solana. For upgradeable contracts, an additional layer reads the actual proxy pattern — EIP-1967 transparent and UUPS layouts, EIP-1822, beacon and diamond variants — because an upgradeable contract's real risk lives in who controls the upgrade.
The source code is then analysed for the classes of defect that drain contracts: reentrancy, access-control gaps, unchecked external calls, arithmetic errors, upgrade backdoors and the rest of a twenty-plus category list. Findings are graded Critical, High, Medium, Low or Informational, and each carries a description and a recommended remediation.
The score is computed last, from facts rather than from prose. Every collected fact contributes to one of nine factor groups: contract administration, holder concentration, liquidity and market, token taxes, token age, severity-weighted findings, per-token variance, proxy upgrade controls, and the Solana-specific set.
| Group | What it measures |
|---|---|
| Contract administration | Ownership state, mint capability, verification, proxy patterns |
| Holder concentration | Top-holder distribution and the shape of the supply curve |
| Liquidity & market | Depth, lock state, volume-to-liquidity ratios, wash-trading signatures |
| Token taxes | Buy and sell tax configuration; asymmetric and elevated rates |
| Token age | Time since pair creation, as an uncertainty premium |
| Severity-weighted findings | Source-code findings, weighted by severity |
| Per-token variance | Contract-seeded variance, so identical fact sets stay distinguishable |
| Proxy upgrade controls | For upgradeable contracts: who can upgrade, and how |
| Solana-specific set | Mint and freeze authority, program ownership, LP lock state |
The group names are published. The individual weights are not, and the reason is stated openly on the methodology page: a deployer who knows the exact weights can engineer a contract that passes the score while remaining unsafe. Publishing the weight table would be publishing a bypass guide. The groups tell an honest reader what is measured; withholding the weights keeps the measurement worth reading.
Why Solana Is Handled Separately
SPL tokens are not ERC-20 tokens with a different address format, and auditing them as if they were is the first mental-model error.
A Solana token has no owner in the EVM sense. What it has instead is a mint authority that can create new supply, a freeze authority that can immobilise balances, a program owner, and a liquidity pool lock state. Token-2022 mints add a further layer: extensions that can attach transfer hooks or fees after the mint already exists. Quantum Audit applies a Solana-specific factor set to these, rather than mapping them onto EVM concepts that do not fit.
Solana is the largest single network in the published record, which makes this less of a nicety than it sounds.
What the Platform Actually Gives You
An on-demand audit. Submit any contract address on Ethereum, BNB Chain, Polygon or Solana, verified or not, and receive a full report: severity-graded findings, category ratings, a security checklist, liquidity analysis, the score with its contributing signals, and a plain-language recommendation. The report downloads as a PDF, and a follow-up chat answers questions about the specific findings.
Five audits per calendar month are free. There is no email-and-password account to create; audits are tied to a Telegram identity, which is what carries the free allowance and links a report to whoever requested it.
A public token security dashboard. As of September 2026, quantumaudit.app/token/ holds 974 published token analyses across Solana, BNB Chain, Ethereum, Base and Arbitrum. Each entry is a full analysis, not a summary card: findings, ratings, the score breakdown, an audit history showing how the score moved over time, and links to related audits. Three ranking panels — lowest risk, highest risk, and most re-verified this week — are computed from that same record.
An open corpus. Roughly eight hundred audit reports are published as Markdown at github.com/quantumauditapp/smart-contract-audits, organised by chain. The methodology can be checked against the underlying on-chain facts by anyone, without asking permission.
Who It Is For
The same report serves three different readers, and the platform does not adjust it for any of them.
A founder uses it before launch to find what an auditor would find, and after launch to demonstrate that the contract holds up. An investor or trader uses it to answer whether a specific contract can take their funds. A researcher or sceptic uses it to check a claim someone else has made.
The result reflects the state of the contract, not the identity of whoever asked. The same contract produces the same score regardless of who runs it — which is the only property that makes a founder's own published audit worth anything to a stranger reading it.
What Quantum Audit Is Not
Being specific about the boundaries is part of being useful.
It is not a manual audit firm. There is no team of human reviewers spending three weeks on a codebase. Where a protocol is holding significant value, a manual review from a specialist firm is the right instrument, and this is a different one.
It is not a coverage-volume play. The dashboard is a record of analyses actually performed, not a claim to have indexed every token in existence.
It is not a real-time monitor. Audits happen on request. There is no live event detection, no alerting on a contract you are watching.
It is not an opinion platform. Scores are deterministic outputs of a fact-weighted function. A high score is not a judgement about a project's team or intentions; it is what the contract's own state produced.
It makes no compliance claims. Nothing here is an attestation, and it is not offered as one.
It does not fix code, host bug bounties, or issue guarantees. Findings are surfaced with recommendations; acting on them belongs to whoever owns the contract.
Where the Work Is Published
Nothing about the method is held back except the weights, and that exception is explained rather than assumed.
The scoring system itself — data sources, the nine factor groups, severity grading, the Solana set and a worked example — is documented in full on the methodology page. The dashboard is the running record of what that system has produced. The GitHub corpus is the same record in plain Markdown, organised by chain, for anyone who would rather read a thousand reports than trust a summary of them.
Long-form research is published on Paragraph, which mirrors to Arweave and distributes through XMTP, Farcaster and Lens. Shorter analysis appears on this blog.
FAQ
What is Quantum Audit?
Quantum Audit is an automated smart contract security analysis platform for Web3. It reads verified contract source code, fuses on-chain data from several independent registries, and returns severity-graded findings alongside a deterministic risk score. Every published analysis includes the specific signals that produced its score.
Who is behind Quantum Audit?
Quantum Audit is an independent project rather than an audit firm with a review team. That constraint shapes the product: the scoring function is deterministic and published, the full methodology is public, and every completed analysis is mirrored to an open corpus, so the output can be checked without taking anyone's word for it. The score itself is never for sale — there is no paid placement, no paid removal, and no way for money to change a verdict.
Is Quantum Audit free?
Five audits per calendar month are free, including the full report and PDF. The published dashboard and the open audit corpus are free to read with no account at all. Higher volume requires a subscription.
Which blockchains does Quantum Audit support?
On-demand audits run on Ethereum, BNB Chain, Polygon and Solana. The published dashboard additionally holds analyses for Base and Arbitrum.
Is the risk score generated by AI?
No, and this is the central design decision. A language model reads the source and surfaces findings. A separate deterministic function converts collected facts — including the severity of those findings — into the score. The same contract in the same on-chain state scores identically on every run.
Does Quantum Audit replace a manual audit?
No. For a protocol holding significant value, a manual review from a specialist firm remains the correct instrument. Quantum Audit covers the ground below that threshold: contracts that would otherwise ship with no review at all, and the continuous re-checking that a one-off manual audit does not provide.
Why are the scoring weights not published?
Because a deployer who knows the exact weights can engineer a contract that scores well while remaining unsafe. The nine factor groups and their logic are published; the per-signal weights are withheld deliberately, and the reasoning is stated on the methodology page rather than left implicit.
The score is arithmetic, the arithmetic is published, and the evidence sits attached to the number. Anyone who wants to argue with a verdict has what they need to argue with it.
Run a contract through Quantum Audit and read the result against the published methodology. The OWASP Smart Contract Top 10 is a useful companion for reading what the findings mean.