On-chain security analysis — is it a scam or legit?
The ArbMCBv2 contract is an upgradeable ERC-20 token implementation on Arbitrum designed for cross-chain bridging.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 26, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xc2d2…bebb0x1c1d…e3ad0xdfb6…cfc5The bridgeBurn function allows the bridge gateway to directly reduce the balance of any user address. This grants the controller the power to remove tokens from any holder's wallet.
Restrict the ability to burn tokens to the user's own address or implement a circuit breaker that prevents mass-burning of user funds.
Unresolved
The functions bridgeMint and mint allow authorized addresses to create new tokens. This increases the total supply and dilutes the value of existing holdings.
Implement a hard cap on the total supply or require a multi-step governance process for any minting operations to prevent unauthorized supply expansion.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0xc2d2…bebb — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 85.7% of supply. Of that, 3.4% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 9.5% in wallets, 72.9% in other contracts. 5,897 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as MUX Protocol (MCB), market cap $6M, rank #1472. 5,897 holders.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $655K (DexScreener, all pools). 24h trading volume $38K (CoinGecko, all markets, daily snapshot). 24h trading volume $89K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $68.36 on 2021-10-16; the price is now 97.5033% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. The class itself adds no points; the contract and market facts decide the score. Basis: bridge-mint functions in its code. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $655K of DEX liquidity across 3 pools. Launch: 1507 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
The ArbMCBv2 contract is an upgradeable ERC-20 token implementation on Arbitrum designed for cross-chain bridging. The architecture relies on centralized roles and gateway permissions to manage supply and cross-chain synchronization. While the core token logic is standard, the presence of privileged functions that can manipulate user balances and total supply introduces significant centralization risks.
The contract utilizes OpenZeppelin's upgradeable standards (7.1 Architecture) and follows standard ERC-20 patterns (7.2 Code Security). The implementation is clean and leverages established libraries for access control (7.3 Access Control). However, the reliance on external L1/L2 messaging (7.6 External) requires high trust in the bridge gateway configuration.
Economic control is centralized within the bridge gateway and designated minter roles (7.4 Economic). Governance (7.5 Governance) is managed via a multisig proxy admin, providing a layer of protection against single-point-of-failure. The ability to mint or burn tokens at will (7.8 Operations) represents a significant trust requirement for token holders.
The contract employs a Transparent Proxy pattern (7.7 Upgrades) managed by a multisig wallet. This setup allows for secure, controlled updates to the logic contract. The upgrade process is transparent and requires a 4-of-8 multisig threshold, mitigating risks of malicious logic injection.
Token holders should be aware that the protocol administrators possess the technical capability to alter the total supply and individual user balances.
It is recommended that the protocol transition to a decentralized governance model or implement time-locks on privileged functions to increase transparency and trust. Ensure that the multisig signers are geographically and organizationally distributed to prevent collusion. Regular monitoring of the bridge gateway activity is advised to detect any unauthorized or anomalous minting/burning events.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The MUX Protocol (MCB) contract on Arbitrum is 0x4e352cf164e64adcbad318c3a1e222e9eba4ce42. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for MUX Protocol is 64/100 (Medium risk) as of Oct 26, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 26, 2026). Total DEX liquidity: $654.8K.
As of Oct 26, 2026, the 10 largest holders own 85.7% of the supply across 5,897 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
