Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Coinbase Wrapped Staked ETH Safe?

CBETHBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance3/10Upgrades1/10Checks passed1 of 5Findings1 High · 2 Medium · 1 Info4
SummaryAI Copilot

This audit covers an upgradeable ERC20 token, UpgradeableOptimismMintableERC20, deployed on the Base network via an EIP-1967 Transparent Proxy.

Read the full analysis
What raised the score
  • Ownership not renounced
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
Exact factors
  • Ownership NOT renounced (admin/mint authority retained)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Top-10 concentration > 30% (91.7% total → 37.1% effective; 0.7% in EOAs, 90.9% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 41 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable

Holders

as of audit · Sep 4, 2026
90.9%Contracts8.3%Everyone else
90.9%Contracts8.3%
ContractsWalletsEveryone elseBubble area = share of supply
91.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking90.9%
  • Walletsanonymous holders, free to sell0.7%
  • Everyone elsethe rest of the supply8.3%
Effective concentrationwhat the score reads37.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$7.49M across 30 pairs
Show 4 more pairs

The 20 remaining pairs hold $335.7K between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$2.82MShare of depth37.7%
Top-1 Unlocked Holder32.3%
Top-3 Unlocked61.5%
Unlocked LP held by
0xf8cd…1a740x9abb…27e70x0ba0…c30b0x752c…751d0xc004…785d0x0fdc…40cd0xbcc1…777f0x34cc…9a600x9e5b…d9230x245f…c5c9

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High2 Medium1 Info
High

Centralized Control over Token Supply (Minting)

The UpgradeableOptimismMintableERC20 contract, as indicated by has_mint: true in the prefill, includes a minting function. This grants a privileged role (likely an owner or minter) the ability to create new tokens, introducing a significant economic risk due to potential arbitrary inflation of the token supply. This centralizes control over the token's economic model, which could devalue existing tokens if misused.H-01

Issue

The UpgradeableOptimismMintableERC20 contract, as indicated by has_mint: true in the prefill, includes a minting function. This grants a privileged role (likely an owner or minter) the ability to create new tokens, introducing a significant economic risk due to potential arbitrary inflation of the token supply. This centralizes control over the token's economic model, which could devalue existing tokens if misused.

Fix

Clearly document the role responsible for minting, the conditions under which minting can occur, and any governance processes required. Consider implementing a timelock for minting operations to provide transparency and allow for community oversight. If possible, explore mechanisms to decentralize or restrict minting capabilities over time.

Status

Unresolved

Medium

Upgradeability via Multisig Admin

The contract is upgradeable via an EIP-1967 Transparent Proxy, with administration controlled by a 3/6 multisig. While the multisig provides a layer of security by requiring multiple approvals, any upgrade introduces inherent risks such as potential for logic errors, storage collisions, or malicious changes if the multisig signers are compromised or collude. Upgrades always carry a non-zero risk of introducing new vulnerabilities.M-01

Issue

The contract is upgradeable via an EIP-1967 Transparent Proxy, with administration controlled by a 3/6 multisig. While the multisig provides a layer of security by requiring multiple approvals, any upgrade introduces inherent risks such as potential for logic errors, storage collisions, or malicious changes if the multisig signers are compromised or collude. Upgrades always carry a non-zero risk of introducing new vulnerabilities.

Fix

Implement a robust upgrade process including comprehensive testing on a staging environment before deployment to production. Conduct independent audits of all proposed upgrade logic. Consider adding a timelock to the proxy admin to allow for a delay between an upgrade proposal and its execution, providing a window for review and potential intervention.

Status

Unresolved

Medium

Potential for Reentrancy in Derived Contracts via _beforeTokenTransfer Hook

The _transfer function in ERC20Upgradeable includes a call to _beforeTokenTransfer, which is an internal virtual function. While the base OpenZeppelin implementation is safe, if the UpgradeableOptimismMintableERC20 contract (or any future derived contract) overrides this hook with external calls or state-changing logic before updating balances, it could introduce reentrancy vulnerabilities. This is a common pattern for custom logic but requires careful implementation to avoid security pitfalls.M-02

Issue

The _transfer function in ERC20Upgradeable includes a call to _beforeTokenTransfer, which is an internal virtual function. While the base OpenZeppelin implementation is safe, if the UpgradeableOptimismMintableERC20 contract (or any future derived contract) overrides this hook with external calls or state-changing logic before updating balances, it could introduce reentrancy vulnerabilities. This is a common pattern for custom logic but requires careful implementation to avoid security pitfalls.

Fix

When overriding _beforeTokenTransfer in UpgradeableOptimismMintableERC20 or any derived contract, ensure that no external calls are made before all state changes related to the transfer are finalized. Follow the Checks-Effects-Interactions pattern strictly. If external calls are necessary, implement reentrancy guards.

Status

Unresolved

Info

Dependency on External Multisig Security

The overall security of the system, particularly regarding upgrades and administrative actions, is highly dependent on the security practices and trustworthiness of the 3/6 multisig signers controlling the proxy admin. Compromise of the required number of keys (3 out of 6) could lead to unauthorized control over the contract, including malicious upgrades or administrative actions.I-01

Issue

The overall security of the system, particularly regarding upgrades and administrative actions, is highly dependent on the security practices and trustworthiness of the 3/6 multisig signers controlling the proxy admin. Compromise of the required number of keys (3 out of 6) could lead to unauthorized control over the contract, including malicious upgrades or administrative actions.

Fix

Ensure that the multisig signers are diverse, geographically distributed, and employ strong key management practices (e.g., hardware wallets, secure offline storage). Regularly review and update multisig signers as personnel or security requirements change. Consider implementing a robust incident response plan for potential multisig key compromises.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit covers an upgradeable ERC20 token, UpgradeableOptimismMintableERC20, deployed on the Base network via an EIP-1967 Transparent Proxy. The contract utilizes OpenZeppelin's Initializable and ERC20Upgradeable patterns, providing a solid foundation. Key risks identified include the centralized control over token supply through a minting function and the inherent complexities associated with upgradeable contracts, despite being managed by a multisig.

Technical6/10Medium risk

The contract leverages OpenZeppelin's battle-tested ERC20Upgradeable and Initializable patterns, providing a robust and secure foundation (7.1 Architecture, 7.2 Code Security). Solidity 0.8.15 mitigates integer overflow/underflow by default, and the AddressUpgradeable library is standard. However, the _beforeTokenTransfer hook, if overridden in the full UpgradeableOptimismMintableERC20 contract, could introduce reentrancy risks if not carefully implemented (7.2 Code Security).

Governance3/10High risk

The prefill indicates the presence of a minting function, which implies a centralized authority can control the token supply (7.4 Economic). This introduces a significant economic risk due to potential arbitrary inflation. The proxy administration is secured by a 3/6 multisig, enhancing governance security for upgrades (7.5 Governance), but the power to mint new tokens represents a critical economic control point.

Upgrades1/10High risk

The contract is deployed behind an EIP-1967 Transparent Proxy, managed by a 3/6 multisig (7.7 Upgrades). This setup allows for secure future upgrades, reducing single points of failure for administrative actions. The Initializable pattern is correctly used to prevent re-initialization, but careful management of storage slots during upgrades is crucial to avoid potential issues.

Final RecommendationWhat to do about this score

It is recommended to ensure the multisig signers are well-known, trusted entities with robust key management practices.

A clear, documented process for upgrade proposals and execution, including thorough testing on a staging environment, should be established. For critical administrative actions, especially minting or upgrades, consider implementing a timelock to provide a window for community review and reaction, enhancing transparency and security.

Contract & Record

1 audit on record
TypeProxy
NetworkBase
Token age1y
Contract0x2ae3…ec22
Deployer0x0cf9…aca1
Proxy Upgrade Controls
Proxy TypeEip1967 Transparent
AdminMultisig · 3-of-6
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Coinbase Wrapped Staked ETH security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 11, 202648Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the CBETH contract address?

The Coinbase Wrapped Staked ETH (CBETH) contract on Base is 0x2ae3f1ec7f1f5012cfeab0185bfc7aa3cf0dec22. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Coinbase Wrapped Staked ETH a scam?

Quantum Audit's risk score for Coinbase Wrapped Staked ETH is 48/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is CBETH liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $7.49M.

Who holds CBETH?

As of Sep 4, 2026, the 10 largest holders own 91.7% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
The Innovation GameTIG · Base48MediumBasemateBase48MediumCAPACITRBase48MediumKAITOBase48MediumiPodBase48MediumA Society For AI Agents1F916 · Base48Medium

Would You Like a More Detailed Audit of Coinbase Wrapped Staked ETH?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page