On-chain security analysis — is it a scam or legit?
EthereumThe audit focused on the TransparentUpgradeableProxy contract.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xd011…29160x62af…d6300x7fe6…f1c20xb432…bdeb0xa660…7554No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The proxy contract () points to an implementation contract () whose source code is not publicly verified on the blockchain explorer. This prevents any security analysis of the actual business logic, potential vulnerabilities (e.g., reentrancy, access control flaws, integer overflows), and economic implications of the system. Users and auditors cannot ascertain the contract's behavior or safety.
Immediately verify the source code of the implementation contract () on the blockchain explorer. Once verified, a full audit of the implementation's logic should be conducted to identify and mitigate any vulnerabilities.
Unresolved
TransparentUpgradeableProxy deploys and relies on a ProxyAdmin contract (0xaa7b…2cc3) to manage upgrades. The ownership structure of this ProxyAdmin contract is not publicly verifiable or disclosed. If the owner is a single Externally Owned Account (EOA), it represents a single point of failure, making the entire system vulnerable to compromise if that EOA's private key is lost or stolen. This also centralizes control over all future upgrades.H-01The TransparentUpgradeableProxy deploys and relies on a ProxyAdmin contract () to manage upgrades. The ownership structure of this ProxyAdmin contract is not publicly verifiable or disclosed. If the owner is a single Externally Owned Account (EOA), it represents a single point of failure, making the entire system vulnerable to compromise if that EOA's private key is lost or stolen. This also centralizes control over all future upgrades.
Publicly disclose the ownership details of the ProxyAdmin contract. It is strongly recommended that the ProxyAdmin's ownership be transferred to a robust multi-signature wallet (e.g., Gnosis Safe) with a sufficient threshold, or a time-locked governance contract, to enhance security, decentralize control, and provide a delay for critical operations.
Unresolved
The contract utilizes the Transparent Proxy Pattern, a well-established and audited upgradeability pattern from OpenZeppelin. This pattern effectively prevents selector clashes between the proxy and the implementation contract for non-admin calls, ensuring predictable behavior and reducing potential attack vectors.
No specific recommendation. Continue to follow best practices for managing the ProxyAdmin and its ownership.
Unresolved
_admin variable in the TransparentUpgradeableProxy contract is declared as immutable. This design choice ensures that the proxy's direct link to its ProxyAdmin cannot be changed after deployment, preventing unauthorized modifications to the admin address at the proxy level. This enhances the internal security and predictability of the proxy contract itself.I-02The _admin variable in the TransparentUpgradeableProxy contract is declared as immutable. This design choice ensures that the proxy's direct link to its ProxyAdmin cannot be changed after deployment, preventing unauthorized modifications to the admin address at the proxy level. This enhances the internal security and predictability of the proxy contract itself.
No specific recommendation. This is a good security practice for the proxy contract.
Unresolved
The audit focused on the TransparentUpgradeableProxy contract. While the proxy itself is a standard, well-audited OpenZeppelin component, the overall system presents critical risks due to the unverified source code of its implementation contract and the unknown ownership structure of the ProxyAdmin contract that controls upgrades. These factors introduce significant technical, governance, and upgradeability concerns.
The audited TransparentUpgradeableProxy contract (7.1 Architecture, 7.2 Code Security) utilizes the robust and well-audited OpenZeppelin transparent proxy pattern, effectively mitigating selector clashes. Its _admin variable is immutable, enhancing the proxy's internal security. However, a critical technical risk (7.2 Code Security) arises from the associated implementation contract, 'Derive' (), which is not source verified, making its actual logic and potential vulnerabilities unknown. Additionally, the ownership details of the ProxyAdmin (7.3 Access Control) are not publicly verifiable, posing a significant access control concern.
The governance and economic security (7.4 Economic, 7.5 Governance) of the system are severely impacted by the lack of transparency regarding the implementation contract and the ProxyAdmin's ownership. The ProxyAdmin controls all upgrade capabilities, and without knowing if its owner is a robust multisig or a single EOA, there's a high centralization risk. The unverified implementation contract means its economic model and potential for manipulation (e.g., minting, fee changes) cannot be assessed, introducing unknown economic risks.
The system employs the Transparent Proxy pattern (7.7 Upgrades) for upgradeability, a standard and secure mechanism when properly managed. However, the upgrade process carries significant risks due to two primary factors. Firstly, the implementation contract is not source verified, meaning any future upgrade could introduce arbitrary, unaudited, and potentially malicious logic. Secondly, the ownership structure of the ProxyAdmin contract, which is responsible for initiating upgrades, is unknown, raising concerns about centralized control and potential compromise of the upgrade path.
It is critical to verify the source code of the implementation contract () to allow for a comprehensive security audit of its logic and functionality.
Additionally, the ownership of the ProxyAdmin contract () should be publicly disclosed and ideally managed by a robust multi-signature wallet or a time-locked governance mechanism to mitigate centralization risks and enhance upgrade security.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Derive (DRV) contract on Ethereum is 0xb1d1eae60eea9525032a6dcb4c1ce336a1de71be. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Derive is 51/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $58.6K.
As of Sep 4, 2026, the 10 largest holders own 89.6% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
