Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is ClawBank Safe?

CLAWBANKBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance7/10Upgrades9/10Checks passed4 of 5Findings1 Medium · 2 Info3
SummaryAI Copilot

The ClankerToken contract is an ERC20 token with extensions for burning, voting, and cross-chain functionality.

Read the full analysis
What raised the score
  • Top-10 concentration > 20%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 85.6%
  • LP top3 unlocked holders = 95.9%
  • 1 Medium finding(s) from audit
Exact factors
  • Top-10 concentration > 20% (41.3% total → 21.8% effective; 8.8% in EOAs, 32.6% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 85.6% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • LP top3 unlocked holders = 95.9% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 44 of 5 checks passed
Contract verifiedVerified
OwnershipRenounced
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
32.6%Contracts8.8%Wallets58.7%Everyone else
32.6%Contracts8.8%58.7%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
41.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking32.6%
  • Walletsanonymous holders, free to sell8.8%
  • Everyone elsethe rest of the supply58.7%
Effective concentrationwhat the score reads21.8%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$285.0K across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$282.8KShare of depth99.2%
Top-1 Unlocked Holder85.6%
Top-3 Unlocked95.9%
Unlocked LP held by
0xd320…dc380xd24c…151b0xe13c…b5a70x0d68…3b7b0xa82b…0e4e0x641e…61d4

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Medium2 Info
Medium

Centralized Control by Admin Role

The _admin role has significant control over the contract, including the ability to update the token's image, metadata, and crucially, to transfer the _admin role itself to any address via updateAdmin, updateImage, and updateMetadata functions. If the _admin key is compromised, an attacker could alter token branding or transfer administrative control, potentially leading to reputational damage or further exploits.M-01

Issue

The _admin role has significant control over the contract, including the ability to update the token's image, metadata, and crucially, to transfer the _admin role itself to any address via updateAdmin, updateImage, and updateMetadata functions. If the _admin key is compromised, an attacker could alter token branding or transfer administrative control, potentially leading to reputational damage or further exploits.

Fix

Implement a multi-signature wallet for the _admin role to require multiple approvals for sensitive operations like updateAdmin. Consider adding a time-lock mechanism for updateAdmin to provide a window for community or team intervention if an unauthorized transfer is initiated. Clearly document the responsibilities and security procedures for managing the _admin key.

Status

Unresolved

Info

Reliance on External Bridge Security

The crosschainMint and crosschainBurn functions are critical for maintaining the token's supply consistency across chains. These functions are exclusively callable by Predeploys.SUPERCHAIN_TOKEN_BRIDGE. The security and integrity of the ClankerToken's cross-chain operations are entirely dependent on the security of this external bridge contract.I-01

Issue

The crosschainMint and crosschainBurn functions are critical for maintaining the token's supply consistency across chains. These functions are exclusively callable by Predeploys.SUPERCHAIN_TOKEN_BRIDGE. The security and integrity of the ClankerToken's cross-chain operations are entirely dependent on the security of this external bridge contract.

Fix

Ensure that the Predeploys.SUPERCHAIN_TOKEN_BRIDGE contract is rigorously audited, continuously monitored, and maintained with the highest security standards. Any vulnerability in the bridge could directly impact the ClankerToken's supply and value. Consider establishing a robust incident response plan for bridge-related issues.

Status

Unresolved

Info

Fixed Initial Supply Distribution to Deployer

In the constructor, the entire maxSupply_ is minted to msg.sender (the contract deployer) if block.chainid matches initialSupplyChainId_. This design choice means the initial token distribution is entirely concentrated with the deployer on a specific chain, rather than being distributed or held by a treasury contract.I-02

Issue

In the constructor, the entire maxSupply_ is minted to msg.sender (the contract deployer) if block.chainid matches initialSupplyChainId_. This design choice means the initial token distribution is entirely concentrated with the deployer on a specific chain, rather than being distributed or held by a treasury contract.

Fix

This is a design decision, not a vulnerability. However, it's important for the project to clearly communicate this initial distribution strategy to stakeholders. If not already planned, consider a transparent mechanism for subsequent distribution or management of this initial supply to avoid perceptions of centralization or to fund ecosystem development.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The ClankerToken contract is an ERC20 token with extensions for burning, voting, and cross-chain functionality. It leverages battle-tested OpenZeppelin libraries for core token logic, enhancing code security. Key features include an admin role for metadata management and a one-time verification mechanism by an original admin. Cross-chain minting and burning are restricted to a predefined SuperchainTokenBridge. The primary risk identified is the centralized control held by the _admin role, which can update critical token metadata and transfer its own administrative privileges.

Technical10/10Low risk

The contract demonstrates strong technical foundations (7.1 Architecture, 7.2 Code Security). It inherits from well-audited OpenZeppelin ERC20, ERC20Permit, ERC20Votes, and ERC20Burnable contracts, minimizing common vulnerabilities. Custom logic for cross-chain minting and burning (e.g., crosschainMint, crosschainBurn) is correctly implemented with strict access control, restricting calls to Predeploys.SUPERCHAIN_TOKEN_BRIDGE. The use of custom error types and a modern Solidity compiler (^0.8.28) further enhances code quality and security. No reentrancy or integer overflow/underflow vulnerabilities were identified in the custom logic.

Governance7/10Low risk

The contract's economic model (7.4 Economic) involves a fixed maxSupply_ minted to the deployer on a specific chain, which is a clear design choice. Governance (7.5 Governance) is centralized around an _admin role, which can update token metadata (_image, _metadata) and transfer the admin role itself via updateAdmin. This centralization presents a single point of failure. The _originalAdmin has a one-time verify() function. External dependencies (7.6 External) include the Predeploys.SUPERCHAIN_TOKEN_BRIDGE for cross-chain operations, whose security is critical for the token's integrity.

Upgrades9/10Low risk

The ClankerToken contract is not designed with an upgrade mechanism (7.7 Upgrades), meaning its logic is immutable once deployed. This eliminates risks associated with proxy patterns or upgradeable contracts, such as proxy misconfigurations or upgrade delays. However, it also means that any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a token migration process, which can be complex and costly (7.8 Operations).

Final RecommendationWhat to do about this score

To enhance the security posture, it is crucial to implement robust operational security practices for the _admin key.

Consider multi-signature wallets or time-locks for sensitive administrative actions, especially for transferring the admin role. Additionally, ensure the Predeploys.SUPERCHAIN_TOKEN_BRIDGE is thoroughly audited and maintained, as the token's cross-chain integrity relies heavily on its security. Regular reviews of the administrative access controls and external dependencies are recommended.

Contract & Record

1 audit on record
TypeClankerToken
NetworkBase
Token age5mo
Contract0x1633…eb07
Deployer0xd9ac…6e58
Badge for your website
ClawBank security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202612Low
  2. Jul 23, 20262Low
  3. Jul 22, 202640Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the CLAWBANK contract address?

The ClawBank contract on Base is 0x16332535e2c27da578bc2e82beb09ce9d3c8eb07. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is ClawBank a scam?

Quantum Audit's risk score for ClawBank is 12/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Renounced; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is CLAWBANK liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $285.0K.

Who holds CLAWBANK?

As of Sep 4, 2026, the 10 largest holders own 41.3% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
This Is My IguanaTIMI · Base12LowRUSSELLBase11LowBasecatBase13LowSKI MASK DOGSKI · Base13LowDebtReliefBotDRB · Base10LowSPARKBase14Low

Would You Like a More Detailed Audit of ClawBank?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page