On-chain security analysis — is it a scam or legit?
This audit report is based on the provided contract address 0xb200000000000000000000451d033a5000cb479e on the Base network.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x5eb9…63e9No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The smart contract at address was provided without its corresponding Solidity source code. This prevents any meaningful static or dynamic analysis of the contract's implementation, logic, and potential vulnerabilities (7.2 Code Security, 7.3 Access Control).
Provide the complete and verified Solidity source code for the contract. Ideally, the code should be verified on a block explorer (e.g., Basescan) to ensure transparency and immutability of the deployed logic.
Unresolved
The contract at is not verified on the Base network's block explorer. This lack of verification hinders public transparency and makes it difficult for users and auditors to confirm the deployed bytecode matches any claimed source code (7.8 Operations).
Verify the contract's source code on the Base network's block explorer. This step is crucial for transparency, user trust, and facilitating future audits or incident response.
Unresolved
Without access to the source code, it is impossible to evaluate the contract's architectural design, dependencies, and overall system integration (7.1 Architecture). This includes understanding its role within a larger protocol, its interaction with other contracts, and potential external risks (7.6 External).
Provide the source code and, if applicable, architectural diagrams or documentation detailing the contract's role, dependencies, and interaction patterns within the broader protocol.
Unresolved
This audit report is based on the provided contract address 0xb200000000000000000000451d033a5000cb479e on the Base network. No source code was provided for analysis, therefore a comprehensive security audit could not be performed. The risk levels assigned reflect the absence of information rather than an assessment of the contract's inherent security. A full audit requires access to the complete and verified source code.
A technical review (7.2 Code Security) could not be conducted due to the absence of source code. Without access to the Solidity implementation, it is impossible to assess common vulnerabilities such as reentrancy, integer overflows, or access control flaws (7.3 Access Control). The current technical risk level is 'Low' only because no vulnerabilities could be identified, not because the code is confirmed secure.
An economic and governance review (7.4 Economic, 7.5 Governance) could not be performed without understanding the contract's logic and intended functionality. Potential risks related to tokenomics, flash loan attacks, or oracle manipulation cannot be assessed. The current governance and economic risk level is 'Low' due to lack of information, not confirmed safety.
The upgradeability status (7.7 Upgrades) of the contract cannot be determined without source code. It is unknown if the contract utilizes a proxy pattern (UUPS, Transparent) or if it is immutable. This prevents assessment of potential upgrade safety issues or risks associated with upgrade mechanisms. The current upgrade risk level is 'Low' due to lack of information.
To enable a comprehensive security audit, it is crucial to provide the complete and verified source code for the contract at .
This will allow for a thorough analysis of the contract's logic, identification of potential vulnerabilities, and assessment of its overall security posture across all relevant categories.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Coinbase Wrapped Hyperliquid (CBHYPE) contract on Base is 0xb200000000000000000000451d033a5000cb479e. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Coinbase Wrapped Hyperliquid is 18/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $587.7K.
As of Sep 4, 2026, the 10 largest holders own 47.0% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
