Honeypot, rug-pull and ownership checks
This audit was conducted without access to the contract's source code.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x0121…75c90x87d8…d0dbNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The source code for the contract at is not verified on the block explorer. This lack of transparency prevents users and auditors from understanding the contract's functionality, logic, and potential vulnerabilities. It significantly increases the risk of hidden malicious code or unintended behavior.
Verify the contract's source code on the block explorer. This allows for public scrutiny and independent security analysis, building trust within the community. Ensure the verified code precisely matches the deployed bytecode.
Unresolved
Without access to the source code, the specific functionality, purpose, and internal mechanisms of the contract are unknown. This makes it impossible to assess common security risks such as reentrancy, access control flaws, integer overflows/underflows, or economic manipulation vectors (7.2 Code Security, 7.3 Access Control, 7.4 Economic). Users interact with this contract at a heightened risk.
Provide comprehensive documentation and, ideally, verified source code to explain the contract's intended functionality, design choices, and any known limitations or risks. This transparency is crucial for informed decision-making by users.
Unresolved
The contract is not identified as a proxy, implying it is immutable once deployed. While immutability can be a security feature for well-audited code, for an unverified contract, it means any potential vulnerabilities or bugs present in the bytecode cannot be patched or upgraded (7.7 Upgrades). This locks in any undiscovered flaws, making them permanent and unfixable without a complete redeployment to a new address.
If the contract is intended to be immutable, ensure its source code is rigorously audited and verified before deployment. For unverified immutable contracts, users should be aware that any issues found later cannot be remediated.
Unresolved
This audit was conducted without access to the contract's source code. Therefore, a comprehensive security analysis for vulnerabilities such as reentrancy, access control, or economic exploits could not be performed. The findings are limited to observations based on the provided metadata, primarily highlighting the risks associated with interacting with an unverified contract.
Without access to the contract's source code, a detailed technical analysis (7.1 Architecture, 7.2 Code Security, 7.3 Access Control) is not possible. The contract's functionality and internal logic remain unknown, preventing assessment of common vulnerabilities like reentrancy or integer overflows. This significantly limits the ability to identify specific code-level security strengths or weaknesses, such as proper input validation or secure access control mechanisms.
A thorough assessment of economic and governance risks (7.4 Economic, 7.5 Governance) is not feasible without understanding the contract's logic and its interaction with other protocols or assets. Potential issues like oracle manipulation, economic exploits, or centralized control cannot be identified. The lack of transparency prevents evaluating the contract's resilience to market fluctuations or potential governance attacks.
The contract is not identified as a proxy (is_proxy: false), suggesting it is immutable and not directly upgradeable (7.7 Upgrades). While this eliminates upgrade-related risks like improper upgrade logic or proxy storage collisions, it also means any discovered vulnerabilities cannot be patched without a full redeployment. The immutability implies a fixed design, which can be a strength if the code is secure, but a weakness if critical flaws are present.
It is strongly recommended that users exercise extreme caution when interacting with unverified contracts.
Always prioritize contracts with publicly available and audited source code to ensure transparency and accountability. For developers, ensure all deployed contracts have their source code verified on block explorers to provide transparency and enable community scrutiny, which is crucial for building trust and enhancing security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Basepepe contract on Base is 0xb2000000000000000000002ca4af341e1af6ff01. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Basepepe is 35/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $44.3K.
As of Sep 4, 2026, the 10 largest holders own 32.0% of the supply. The Holders section on this page shows who they are by holder type.
Paste the contract address into our AI-powered scanner for a deeper real-time report — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
