Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is basedpad.fun Safe?

BPADBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical4/10Governance1/10Upgrades4/10Checks passed5 of 7Findings1 Critical · 2 High · 1 Medium · 2 Info6
SummaryAI Copilot

This audit report covers the provided Solidity source code for the BasedPadLaunchpad contract.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k
  • LP top1 unlocked holder = 98.9%
  • LP top3 unlocked holders = 100.0%
  • Token age < 30 days
  • 1 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 30% (52.4% total → 31.6% effective; 17.7% in EOAs, 34.6% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $50k ($29,456 across 12 pairs — thin market)
  • LP top1 unlocked holder = 98.9% (independent LP — depth risk, pool = 96% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 96% of DEX liquidity)
  • Token age < 30 days (still settling)
  • 1 Critical finding(s) from audit
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 45 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
34.6%Contracts17.7%Wallets47.6%Everyone else
34.6%Contracts17.7%Wallets47.6%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
52.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking34.6%
  • Walletsanonymous holders, free to sell17.7%
  • Everyone elsethe rest of the supply47.6%
Effective concentrationwhat the score reads31.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$29.5K across 12 pairs
Show 4 more pairs

The 2 remaining pairs hold $2 between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$28.2KShare of depth95.7%
Top-1 Unlocked Holder98.9%
Top-3 Unlocked100.0%
Unlocked LP held by
0xef7a…ae3b0x7973…108a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical2 High1 Medium2 Info
Critical

Incomplete Code Provided for Audit

The main contract BasedPadLaunchpad is truncated, with only interfaces and utility libraries provided. This prevents a comprehensive security audit of the core business logic, state variables, and critical functions (e.g., pool creation, token distribution, fee handling, access control). Without the full code, any security assessment is inherently incomplete and cannot guarantee the safety of the deployed system.C-01

Issue

The main contract BasedPadLaunchpad is truncated, with only interfaces and utility libraries provided. This prevents a comprehensive security audit of the core business logic, state variables, and critical functions (e.g., pool creation, token distribution, fee handling, access control). Without the full code, any security assessment is inherently incomplete and cannot guarantee the safety of the deployed system.

Fix

Provide the complete and final source code for the BasedPadLaunchpad contract to enable a full and accurate security assessment. This is a prerequisite for a meaningful audit.

Status

Unresolved

High

High Complexity and Potential for Errors in Custom Math Libraries

The FullMath, TickMath, and LaunchMath libraries contain highly optimized, low-level implementations using assembly and complex bitwise operations (e.g., mulDiv, sqrt, getSqrtRatioAtTick). While potentially efficient, these custom implementations are notoriously difficult to get right and are prone to subtle errors, precision issues, or edge-case vulnerabilities that could lead to incorrect calculations, unexpected behavior, or economic exploits within the Uniswap V3 liquidity management.H-01

Issue

The FullMath, TickMath, and LaunchMath libraries contain highly optimized, low-level implementations using assembly and complex bitwise operations (e.g., mulDiv, sqrt, getSqrtRatioAtTick). While potentially efficient, these custom implementations are notoriously difficult to get right and are prone to subtle errors, precision issues, or edge-case vulnerabilities that could lead to incorrect calculations, unexpected behavior, or economic exploits within the Uniswap V3 liquidity management.

Fix

Conduct extensive unit and integration testing for all custom math functions, covering a wide range of inputs, including edge cases and boundary conditions. Consider using battle-tested libraries where possible or engaging specialists for formal verification of these critical math components to ensure their correctness and robustness.

Status

Unresolved

High

Unverified Access Control Mechanisms

Without the full BasedPadLaunchpad contract code, it is impossible to verify the implementation of access control mechanisms. A launchpad contract typically requires robust access control for critical functions such as setting parameters, managing funds, creating pools, or pausing operations. Lack of proper access control could allow unauthorized users to manipulate the contract, steal funds, or disrupt operations, leading to severe financial losses.H-02

Issue

Without the full BasedPadLaunchpad contract code, it is impossible to verify the implementation of access control mechanisms. A launchpad contract typically requires robust access control for critical functions such as setting parameters, managing funds, creating pools, or pausing operations. Lack of proper access control could allow unauthorized users to manipulate the contract, steal funds, or disrupt operations, leading to severe financial losses.

Fix

Implement a robust access control mechanism (e.g., OpenZeppelin's Ownable or AccessControl) for all sensitive functions. Clearly define roles and permissions, and ensure that only authorized addresses can perform privileged actions. This must be a core component of the main contract.

Status

Unresolved

Medium

Unverified Application of ReentrancyGuard

The ReentrancyGuard library is included, which is a positive step towards preventing reentrancy attacks. However, without the full contract code, it cannot be verified if the nonReentrant modifier is correctly applied to all functions that perform external calls and modify state, especially those involving token transfers or liquidity operations. Incorrect or missing application could leave the contract vulnerable to reentrancy.M-01

Issue

The ReentrancyGuard library is included, which is a positive step towards preventing reentrancy attacks. However, without the full contract code, it cannot be verified if the nonReentrant modifier is correctly applied to all functions that perform external calls and modify state, especially those involving token transfers or liquidity operations. Incorrect or missing application could leave the contract vulnerable to reentrancy.

Fix

Ensure that the nonReentrant modifier is applied to all functions that make external calls to untrusted contracts and modify the contract's state. Review all external calls to identify potential reentrancy vectors and confirm the modifier's presence.

Status

Unresolved

Info

Use of unchecked Blocks in Math Libraries

The FullMath and TickMath libraries utilize unchecked blocks for arithmetic operations. While this is a common optimization in low-level math libraries to save gas by bypassing Solidity's default overflow/underflow checks, it places the full responsibility on the developer to ensure that overflows or underflows cannot occur in critical contexts, or that they are handled explicitly through other means.I-01

Issue

The FullMath and TickMath libraries utilize unchecked blocks for arithmetic operations. While this is a common optimization in low-level math libraries to save gas by bypassing Solidity's default overflow/underflow checks, it places the full responsibility on the developer to ensure that overflows or underflows cannot occur in critical contexts, or that they are handled explicitly through other means.

Fix

While acceptable for highly optimized math, ensure that all inputs to unchecked operations are thoroughly validated or constrained to prevent overflows/underflows from leading to incorrect calculations. Comprehensive testing of these math functions is crucial to cover all possible scenarios.

Status

Unresolved

Info

Custom SafeTransfer Implementation

The contract uses a custom SafeTransfer library for ERC20 token interactions. This library correctly handles the return values of transfer and transferFrom calls, which is a good security practice to prevent issues with non-standard ERC20 tokens that might not revert on failure but instead return false.I-02

Issue

The contract uses a custom SafeTransfer library for ERC20 token interactions. This library correctly handles the return values of transfer and transferFrom calls, which is a good security practice to prevent issues with non-standard ERC20 tokens that might not revert on failure but instead return false.

Fix

While the custom implementation appears robust, consider using battle-tested libraries like OpenZeppelin's SafeERC20 for consistency and to leverage community-audited code, potentially reducing the surface area for custom implementation bugs and improving maintainability.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit report covers the provided Solidity source code for the BasedPadLaunchpad contract. A critical limitation of this audit is that the main contract logic for BasedPadLaunchpad was truncated, preventing a comprehensive assessment of its core functionality, state management, and critical business logic. The analysis primarily focuses on the provided interfaces and utility libraries (SafeTransfer, ReentrancyGuard, FullMath, TickMath, LaunchMath). Several high-risk areas were identified, particularly concerning the complexity of custom math libraries and the inability to verify fundamental security controls like access management.

Technical4/10Medium risk

7.1 Architecture: The contract utilizes several custom math libraries (FullMath, TickMath, LaunchMath) for Uniswap V3 calculations, which are highly optimized but introduce significant complexity and potential for subtle errors. 7.2 Code Security: The SafeTransfer library correctly handles ERC20 return values, which is a positive. However, the extensive use of unchecked blocks in custom math requires extreme care. 7.3 Access Control: No access control mechanisms could be verified due to truncated code, which is a critical omission for a launchpad. 7.6 External: Interactions with Uniswap V3 interfaces are defined, but the full scope of external calls cannot be assessed. The ReentrancyGuard is present, but its application to all relevant functions cannot be confirmed.

Governance1/10High risk

7.4 Economic: Without the full contract code, the economic model, fee structures, and token distribution mechanisms of the launchpad cannot be assessed for fairness, sustainability, or potential manipulation vectors. 7.5 Governance: The presence or absence of governance mechanisms, including multi-signature controls or decentralized decision-making, cannot be determined. This poses a high risk as critical operational decisions could be centralized and unverified.

Upgrades4/10Medium risk

7.7 Upgrades: The provided contract is not identified as a proxy, and no upgradeability pattern is evident. Therefore, there are no inherent upgrade safety risks associated with this specific deployment. Changes would require a new deployment.

Final RecommendationWhat to do about this score

A complete and comprehensive security audit requires the full source code of the BasedPadLaunchpad contract.

It is imperative to provide all relevant contract files to enable a thorough review of the core business logic, state management, and critical functions. Special attention should be paid to rigorously testing all custom math libraries for precision, edge cases, and potential overflows/underflows. Implement and verify robust access control mechanisms for all sensitive operations within the launchpad contract.

Contract & Record

1 audit on record
TypeBasedPadLaunchToken
NetworkBase
Token age12d
Contract0xf5f1…8a2b
Deployer0xe5cf…ab04
Badge for your website
basedpad.fun security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202685Critical
  2. Aug 30, 202680High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the BPAD contract address?

The basedpad.fun (BPAD) contract on Base is 0xf5f11bc9be9d6690f795d04d2fc9bdd097008a2b. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is basedpad.fun a scam?

Quantum Audit's risk score for basedpad.fun is 85/100 (Critical risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is BPAD liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $29.5K.

Who holds BPAD?

As of Sep 4, 2026, the 10 largest holders own 52.4% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
FLock.ioFLOCK · Base85CriticalCoinbase Wrapped MEGACBMEGA · Base85CriticalCysicCYS · Base84HighWrapped L1coinWL1 · Base84HighStrike RobotSR · Base87CriticalCrynux TokenCNX · Base87Critical

Would You Like a More Detailed Audit of basedpad.fun?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page