Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Matchain Safe?

MATBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 15, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical5/10Governance4/10Upgrades1/10Checks passed3 of 7Findings2 High · 2 Medium · 4 Info8
SummaryAI Copilot

This audit covers the HypERC20 token contract, an ERC-20 compliant token with cross-chain routing capabilities, deployed behind a TransparentUpgradeableProxy.

Read the full analysis
What raised the score
  • Mintable supply — no cap found, dilution unbounded; held by mailbox: Multisig
  • Upgradeable proxy — the admin can replace the logic; admin: ProxyAdmin -> Multisig
  • Liquidity not locked
  • Top-10 concentration > 30%
  • Code: Funds sent with cross-chain transfers might be lost due to a technical error.
  • Code: A technical flaw could lead to unexpected behavior or vulnerabilities.
Exact factors
  • Mintable supply — no cap found, dilution unbounded; held by mailbox: Multisig
  • Upgradeable proxy — the admin can replace the logic; admin: ProxyAdmin -> Multisig
  • Liquidity NOT locked (100% of the pool; this pool is 78% of DEX liquidity) — held by independent providers — market-depth risk
  • Top-10 concentration > 30% (90.3% total → 47.4% effective; 19.2% in EOAs, 70.4% in contracts; 0.7% burned, locked or in pools excluded)
  • Code: Funds sent with cross-chain transfers might be lost due to a technical error. (High, static analysis)
  • Code: A technical flaw could lead to unexpected behavior or vulnerabilities. (High, static analysis)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 153 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 15, 20264,760 holders
70.4%Contracts19.2%Wallets9.7%Everyone else
70.4%Contracts19.2%Wallets9.7%
ContractsWalletsDEX poolsEveryone elseBubble area = share of supply
90.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking70.4%
  • Walletsanonymous holders, free to sell19.2%
  • DEX poolsthe pools' own liquidity0.7%
  • Everyone else4,750 holders9.7%
Effective concentrationwhat the score reads47.4%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 15, 2026

Liquidity

as of audit · Oct 15$131.8K across 5 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$102.5KShare of depth77.7%
Top-1 Unlocked Holder42.1%
Top-3 Unlocked61.7%
Unlocked LP held by
0xf949…02980x3b0c…3fcd0xce94…07ca0x0360…692a0x71a0…4e0b0x1498…d27e0x5fbe…94c40x501a…003e0x570b…afc10xf517…9fd5

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 High2 Medium4 Info
High

Funds sent with cross-chain transfers might be lost due to a technical error.

When you initiate a cross-chain transfer using functions like transferRemote(uint32,bytes32,uint256) or transferRemote(uint32,bytes32,uint256,bytes,address), you might send Ether (ETH) along with your token transfer to cover gas or other costs. However, the internal _dispatch function, which processes these transfers, is not designed to receive Ether. This means any Ether sent with these transactions could be stuck in the contract and become inaccessible, effectively leading to a loss of funds.CD-01

Issue

When you initiate a cross-chain transfer using functions like transferRemote(uint32,bytes32,uint256) or transferRemote(uint32,bytes32,uint256,bytes,address), you might send Ether (ETH) along with your token transfer to cover gas or other costs. However, the internal _dispatch function, which processes these transfers, is not designed to receive Ether. This means any Ether sent with these transactions could be stuck in the contract and become inaccessible, effectively leading to a loss of funds.

Fix

The project team must immediately fix the _dispatch function to correctly handle or reject Ether sent with cross-chain transfers. Token holders should exercise caution when sending Ether with transferRemote functions until this issue is confirmed to be resolved.

Status

Unresolved

High

A technical flaw could lead to unexpected behavior or vulnerabilities.

The contract has a technical issue where a variable or function in a derived contract has the same name as one in a base contract, but they refer to different underlying storage or logic. This 'shadowing' can cause confusion, lead to unintended behavior, or even introduce security vulnerabilities if the contract's logic relies on the shadowed state in an unexpected way. This could potentially affect how the contract manages its internal state and operations.CD-02

Issue

The contract has a technical issue where a variable or function in a derived contract has the same name as one in a base contract, but they refer to different underlying storage or logic. This 'shadowing' can cause confusion, lead to unintended behavior, or even introduce security vulnerabilities if the contract's logic relies on the shadowed state in an unexpected way. This could potentially affect how the contract manages its internal state and operations.

Fix

The project team should address this state shadowing issue to ensure the contract's logic is clear, predictable, and secure. This typically involves renaming variables or functions to avoid conflicts and ensure that the correct state is always being accessed and modified.

Status

Unresolved

Medium

The mailbox controller can create new tokens, potentially diluting your holdings.

The contract allows a specific controller, referred to as the mailbox, to create new tokens out of thin air. Functions like transferRemote(uint32,bytes32,uint256), transferRemote(uint32,bytes32,uint256,bytes,address), and handle(uint32,bytes32,bytes) can increase the total supply of tokens. If this mailbox controller is compromised or misused, it could lead to an unlimited creation of tokens, reducing the value of every token you hold.CP-01

Issue

The contract allows a specific controller, referred to as the mailbox, to create new tokens out of thin air. Functions like transferRemote(uint32,bytes32,uint256), transferRemote(uint32,bytes32,uint256,bytes,address), and handle(uint32,bytes32,bytes) can increase the total supply of tokens. If this mailbox controller is compromised or misused, it could lead to an unlimited creation of tokens, reducing the value of every token you hold.

Fix

Token holders should be aware that the mailbox controller has significant power over the token supply. The project team should implement strict governance and security measures around the mailbox controller's private keys or access, potentially using a multi-signature wallet or a time-locked contract for these operations to add an extra layer of security.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 85.5% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 78% of the token's DEX liquidity; the other pools were not assessed.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 85.5% is held, unlocked, by 10 address(es) other than the owner/deployer. No single one holds a majority: their exits thin the market rather than hand anyone the pool. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 78% of the token's DEX liquidity; the other pools were not assessed.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

Who holds the supply

The ten largest holders own 90.3% of supply. Of that, 0.7% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 19.2% in wallets, 70.4% in other contracts. 4,760 holders in total.QA-HOLDERS

Issue

The ten largest holders own 90.3% of supply. Of that, 0.7% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 19.2% in wallets, 70.4% in other contracts. 4,760 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Listed, but not independently verified

Listed on CoinGecko as Matchain (MAT), rank #3734. 4,760 holders.QA-IDENTITY

Issue

Listed on CoinGecko as Matchain (MAT), rank #3734. 4,760 holders.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $132K (DexScreener, all pools). 24h trading volume $795K (CoinGecko, all markets, daily snapshot). 24h trading volume $550K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $3.27 on 2025-06-19; the price is now 98.0167% below it.QA-MARKET

Issue

Liquidity $132K (DexScreener, all pools). 24h trading volume $795K (CoinGecko, all markets, daily snapshot). 24h trading volume $550K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $3.27 on 2025-06-19; the price is now 98.0167% below it.

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Governance token

A token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-5 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $132K of DEX liquidity across 5 pools. Launch: 484 days of market history.QA-PROFILE

Issue

A token whose main use is voting on a protocol's decisions (delegation and vote checkpoints in its code). The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Governance. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-5 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $132K of DEX liquidity across 5 pools. Launch: 484 days of market history.

Fix

Check how much of the voting supply insiders hold and what governance can change.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 15
Executive SummaryWhat the contract is and what the review found

This audit covers the HypERC20 token contract, an ERC-20 compliant token with cross-chain routing capabilities, deployed behind a TransparentUpgradeableProxy. The contract exhibits standard ERC-20 functionality and integrates with a mailbox system for interchain communication. Key findings include a medium-severity issue allowing a privileged 'mailbox' address to mint tokens, and two high-severity technical issues related to handling msg.value in a non-payable function and a state shadowing vulnerability. The contract owner is a multisig, enhancing control over administrative functions and upgrades.

Technical5/10Medium risk

The contract implements standard ERC-20 functionality and integrates cross-chain messaging via TokenRouter and MailboxClient (7.1 Architecture). However, two high-severity technical issues were identified (7.2 Code Security): the _dispatch function incorrectly receives msg.value in a non-payable context (CD-01), which could lead to stuck funds. Additionally, a state shadowing issue (CD-02) could result in unexpected behavior or vulnerabilities, impacting code reliability.

Governance4/10Medium risk

The contract utilizes OwnableUpgradeable for administrative functions, with ownership held by a multisig (3/5 threshold), enhancing security for critical operations like setDestinationGas and transferOwnership (7.3 Access Control, 7.5 Governance). However, a mailbox role has the ability to mint new tokens via transferRemote and handle functions (CP-01), which could dilute existing token holders if misused (7.4 Economic). This centralizes significant economic power in the mailbox controller.

Upgrades1/10High risk

The contract is deployed behind a TransparentUpgradeableProxy, allowing for future upgrades to fix bugs or add features without redeploying the entire system (7.7 Upgrades). The upgrade mechanism is controlled by a multisig (3/5 threshold), providing a robust governance layer for upgrade decisions. While upgrades offer flexibility, they introduce inherent risks; malicious or buggy upgrades could compromise the contract's integrity or funds, necessitating careful auditing of all upgrade proposals.

Final RecommendationWhat to do about this score

Prioritize resolving the high-severity technical issues, specifically the msg.value in non-payable function _dispatch and the state shadowing concern.

Implement robust access controls and monitoring for the mailbox role, given its ability to mint new tokens, to prevent unauthorized supply inflation. Ensure all future upgrade proposals undergo thorough security audits before deployment to mitigate risks associated with upgradeability.

Contract & Record

1 audit on record
TypeTransparentUpgradeableProxy
NetworkBNB Chain
Token age1y
Contract0xfe2d…bab0
Deployer0xa7ec…d9ba
Proxy Upgrade Controls
Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin → Multisig 3-of-5
ImplementationVerified source
Audit History
  1. Oct 15, 202668High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Billions Network TokenBILL · BNB Chain68HighHemiBNB Chain68HighAntFunBNB Chain68HighUniswapUNI · BNB Chain68HighReservoirDAM · BNB Chain68HighQuack AI TokenQ · BNB Chain67High

Would You Like a More Detailed Audit of Matchain?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page