Quantum Audit Logo

Is ClawBank Safe?

On-chain security analysis — is it a scam or legit?

ClawBank CLAWBANK
0x1633…eb07
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Low Risk
Executive SummaryAI Copilot

The ClankerToken contract is an ERC20 token with extensions for burning, voting, and cross-chain functionality. It leverages battle-tested OpenZeppelin libraries for core token logic, enhancing code security. Key features include an admin role for metadata management and a one-time verification mechanism by an original admin. Cross-chain minting and burning are restricted to a predefined SuperchainTokenBridge. The primary risk identified is the centralized control held by the `_admin` role, which can update critical token metadata and transfer its own administrative privileges.

1 Medium2 Informational
Volume 24h
$34.4K
Liquidity
$282.8K
Price
$0.000008912
Token Age
5mo
Top 10 Holders
41.3%

Security Findings

1 Med2 Info
Medium

Centralized Control by Admin Role

M-01The `_admin` role has significant control over the contract, including the ability to update the token's image, metadata, and crucially, to transfer the `_admin` role itself to any address via `updateAdmin`, `updateImage`, and `updateMetadata` functions. If the `_admin` key is compromised, an attacker could alter token branding or transfer administrative control, potentially leading to reputational damage or further exploits.
IssueThe `_admin` role has significant control over the contract, including the ability to update the token's image, metadata, and crucially, to transfer the `_admin` role itself to any address via `updateAdmin`, `updateImage`, and `updateMetadata` functions. If the `_admin` key is compromised, an attacker could alter token branding or transfer administrative control, potentially leading to reputational damage or further exploits.
FixImplement a multi-signature wallet for the `_admin` role to require multiple approvals for sensitive operations like `updateAdmin`. Consider adding a time-lock mechanism for `updateAdmin` to provide a window for community or team intervention if an unauthorized transfer is initiated. Clearly document the responsibilities and security procedures for managing the `_admin` key.
StatusUnresolved
Info

Reliance on External Bridge Security

I-01The `crosschainMint` and `crosschainBurn` functions are critical for maintaining the token's supply consistency across chains. These functions are exclusively callable by `Predeploys.SUPERCHAIN_TOKEN_BRIDGE`. The security and integrity of the ClankerToken's cross-chain operations are entirely dependent on the security of this external bridge contract.
IssueThe `crosschainMint` and `crosschainBurn` functions are critical for maintaining the token's supply consistency across chains. These functions are exclusively callable by `Predeploys.SUPERCHAIN_TOKEN_BRIDGE`. The security and integrity of the ClankerToken's cross-chain operations are entirely dependent on the security of this external bridge contract.
FixEnsure that the `Predeploys.SUPERCHAIN_TOKEN_BRIDGE` contract is rigorously audited, continuously monitored, and maintained with the highest security standards. Any vulnerability in the bridge could directly impact the ClankerToken's supply and value. Consider establishing a robust incident response plan for bridge-related issues.
StatusUnresolved
Info

Fixed Initial Supply Distribution to Deployer

I-02In the constructor, the entire `maxSupply_` is minted to `msg.sender` (the contract deployer) if `block.chainid` matches `initialSupplyChainId_`. This design choice means the initial token distribution is entirely concentrated with the deployer on a specific chain, rather than being distributed or held by a treasury contract.
IssueIn the constructor, the entire `maxSupply_` is minted to `msg.sender` (the contract deployer) if `block.chainid` matches `initialSupplyChainId_`. This design choice means the initial token distribution is entirely concentrated with the deployer on a specific chain, rather than being distributed or held by a treasury contract.
FixThis is a design decision, not a vulnerability. However, it's important for the project to clearly communicate this initial distribution strategy to stakeholders. If not already planned, consider a transparent mechanism for subsequent distribution or management of this initial supply to avoid perceptions of centralization or to fund ecosystem development.
StatusUnresolved

Category Ratings

TechnicalLow10/10

The contract demonstrates strong technical foundations (7.1 Architecture, 7.2 Code Security). It inherits from well-audited OpenZeppelin ERC20, ERC20Permit, ERC20Votes, and ERC20Burnable contracts, minimizing common vulnerabilities. Custom logic for cross-chain minting and burning (e.g., `crosschainMint`, `crosschainBurn`) is correctly implemented with strict access control, restricting calls to `Predeploys.SUPERCHAIN_TOKEN_BRIDGE`. The use of custom error types and a modern Solidity compiler (`^0.8.28`) further enhances code quality and security. No reentrancy or integer overflow/underflow vulnerabilities were identified in the custom logic.

GovernanceLow7/10

The contract's economic model (7.4 Economic) involves a fixed `maxSupply_` minted to the deployer on a specific chain, which is a clear design choice. Governance (7.5 Governance) is centralized around an `_admin` role, which can update token metadata (`_image`, `_metadata`) and transfer the admin role itself via `updateAdmin`. This centralization presents a single point of failure. The `_originalAdmin` has a one-time `verify()` function. External dependencies (7.6 External) include the `Predeploys.SUPERCHAIN_TOKEN_BRIDGE` for cross-chain operations, whose security is critical for the token's integrity.

UpgradesLow9/10

The ClankerToken contract is not designed with an upgrade mechanism (7.7 Upgrades), meaning its logic is immutable once deployed. This eliminates risks associated with proxy patterns or upgradeable contracts, such as proxy misconfigurations or upgrade delays. However, it also means that any discovered vulnerabilities or desired feature enhancements would necessitate a new contract deployment and a token migration process, which can be complex and costly (7.8 Operations).

Security Checklist

4/5 checks passed
Contract VerifiedPass
Ownership RenouncedPass
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

41.3% in top 10
8.8% in wallets32.6% in contracts
Effective Concentration21.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$285.0K across 4 pairs
Uniswap v4WETHanalysed$282.8K99.2%Uniswap v3🌙8$2.1K0.7%Quickswap v4WETH$990.0%Uniswap v4USDC$740.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder85.6%
Top-3 Unlocked95.9%

Key Addresses

7 addresses
Deployer
0xd9ac…6e58
Unlocked LP Held By
0xd320…dc380xd24c…151b0xe13c…b5a70x0d68…3b7b0xa82b…0e4e0x641e…61d4

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

5 factors
  • Top-10 concentration > 20% (41.3% total → 21.8% effective; 8.8% in EOAs, 32.6% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 85.6% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • LP top3 unlocked holders = 95.9% (independent LP — depth risk, pool = 99% of DEX liquidity)
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
RUSSELLLow RiskBasecatLow RiskSKI MASK DOG (SKI)Low RiskDebtReliefBot (DRB)Low RiskSPARKLow RiskOpenVPP (OVPP)Low Risk

Would You Like a More Detailed Audit of ClawBank?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit