Quantum Audit Logo

Is Derive Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Derive DRV
0xb1d1…71be
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The audit focused on the `TransparentUpgradeableProxy` contract. While the proxy itself is a standard, well-audited OpenZeppelin component, the overall system presents critical risks due to the unverified source code of its implementation contract and the unknown ownership structure of the `ProxyAdmin` contract that controls upgrades. These factors introduce significant technical, governance, and upgradeability concerns.

1 Critical1 High2 Informational
Volume 24h
$38.9K
Liquidity
$58.6K
Price
$0.158
Token Age
4mo
Top 10 Holders
89.6%

Security Findings

1 Crit1 High2 Info
Critical

Unverified Implementation Contract Source Code

C-01The proxy contract (0xb1d1…71be) points to an implementation contract (0x4909…81b8) whose source code is not publicly verified on the blockchain explorer. This prevents any security analysis of the actual business logic, potential vulnerabilities (e.g., reentrancy, access control flaws, integer overflows), and economic implications of the system. Users and auditors cannot ascertain the contract's behavior or safety.
IssueThe proxy contract () points to an implementation contract () whose source code is not publicly verified on the blockchain explorer. This prevents any security analysis of the actual business logic, potential vulnerabilities (e.g., reentrancy, access control flaws, integer overflows), and economic implications of the system. Users and auditors cannot ascertain the contract's behavior or safety.
FixImmediately verify the source code of the implementation contract () on the blockchain explorer. Once verified, a full audit of the implementation's logic should be conducted to identify and mitigate any vulnerabilities.
StatusUnresolved
High

Unknown/Unverified Ownership of ProxyAdmin Contract

H-01The `TransparentUpgradeableProxy` deploys and relies on a `ProxyAdmin` contract (0xaa7b…2cc3) to manage upgrades. The ownership structure of this `ProxyAdmin` contract is not publicly verifiable or disclosed. If the owner is a single Externally Owned Account (EOA), it represents a single point of failure, making the entire system vulnerable to compromise if that EOA's private key is lost or stolen. This also centralizes control over all future upgrades.
IssueThe `TransparentUpgradeableProxy` deploys and relies on a `ProxyAdmin` contract () to manage upgrades. The ownership structure of this `ProxyAdmin` contract is not publicly verifiable or disclosed. If the owner is a single Externally Owned Account (EOA), it represents a single point of failure, making the entire system vulnerable to compromise if that EOA's private key is lost or stolen. This also centralizes control over all future upgrades.
FixPublicly disclose the ownership details of the `ProxyAdmin` contract. It is strongly recommended that the `ProxyAdmin`'s ownership be transferred to a robust multi-signature wallet (e.g., Gnosis Safe) with a sufficient threshold, or a time-locked governance contract, to enhance security, decentralize control, and provide a delay for critical operations.
StatusUnresolved
Info

Use of Transparent Proxy Pattern

I-01The contract utilizes the Transparent Proxy Pattern, a well-established and audited upgradeability pattern from OpenZeppelin. This pattern effectively prevents selector clashes between the proxy and the implementation contract for non-admin calls, ensuring predictable behavior and reducing potential attack vectors.
IssueThe contract utilizes the Transparent Proxy Pattern, a well-established and audited upgradeability pattern from OpenZeppelin. This pattern effectively prevents selector clashes between the proxy and the implementation contract for non-admin calls, ensuring predictable behavior and reducing potential attack vectors.
FixNo specific recommendation. Continue to follow best practices for managing the `ProxyAdmin` and its ownership.
StatusUnresolved
Info

Immutable Admin Address in Proxy

I-02The `_admin` variable in the `TransparentUpgradeableProxy` contract is declared as `immutable`. This design choice ensures that the proxy's direct link to its `ProxyAdmin` cannot be changed after deployment, preventing unauthorized modifications to the admin address at the proxy level. This enhances the internal security and predictability of the proxy contract itself.
IssueThe `_admin` variable in the `TransparentUpgradeableProxy` contract is declared as `immutable`. This design choice ensures that the proxy's direct link to its `ProxyAdmin` cannot be changed after deployment, preventing unauthorized modifications to the admin address at the proxy level. This enhances the internal security and predictability of the proxy contract itself.
FixNo specific recommendation. This is a good security practice for the proxy contract.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The audited `TransparentUpgradeableProxy` contract (7.1 Architecture, 7.2 Code Security) utilizes the robust and well-audited OpenZeppelin transparent proxy pattern, effectively mitigating selector clashes. Its `_admin` variable is immutable, enhancing the proxy's internal security. However, a critical technical risk (7.2 Code Security) arises from the associated implementation contract, 'Derive' (), which is not source verified, making its actual logic and potential vulnerabilities unknown. Additionally, the ownership details of the `ProxyAdmin` (7.3 Access Control) are not publicly verifiable, posing a significant access control concern.

GovernanceHigh2/10

The governance and economic security (7.4 Economic, 7.5 Governance) of the system are severely impacted by the lack of transparency regarding the implementation contract and the `ProxyAdmin`'s ownership. The `ProxyAdmin` controls all upgrade capabilities, and without knowing if its owner is a robust multisig or a single EOA, there's a high centralization risk. The unverified implementation contract means its economic model and potential for manipulation (e.g., minting, fee changes) cannot be assessed, introducing unknown economic risks.

UpgradesHigh1/10

The system employs the Transparent Proxy pattern (7.7 Upgrades) for upgradeability, a standard and secure mechanism when properly managed. However, the upgrade process carries significant risks due to two primary factors. Firstly, the implementation contract is not source verified, meaning any future upgrade could introduce arbitrary, unaudited, and potentially malicious logic. Secondly, the ownership structure of the `ProxyAdmin` contract, which is responsible for initiating upgrades, is unknown, raising concerns about centralized control and potential compromise of the upgrade path.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyFail

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent
AdminOther-Contract
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

89.6% in top 10
16.2% in wallets73.3% in contracts
Effective Concentration45.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$58.6K

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder71.5%
Top-3 Unlocked95.2%

Key Addresses

6 addresses
Deployer
0x81a1…2d85
Unlocked LP Held By
0xd011…29160x62af…d6300x7fe6…f1c20xb432…bdeb0xa660…7554

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

9 factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Proxy contract (upgradeable — admin can replace logic)
  • Admin is unclassified contract
  • Top-10 concentration > 30% (89.6% total → 45.6% effective; 16.2% in EOAs, 73.3% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 71.5% (independent LP — depth risk)
  • LP top3 unlocked holders = 95.2% (independent LP — depth risk)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Virtuals Protocol (VIRTUAL)High RiskLido DAO (LDO)High RiskEthena (ENA)High RiskUniswap (UNI)High RiskEigenCloud (prev. EigenLayer) (EIGEN)High RiskRelicsHigh Risk

Would You Like a More Detailed Audit of Derive?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit