On-chain security analysis — is it a scam or legit?
BNB ChainThe HypERC20 contract implements an interchain token bridge using a proxy architecture.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 30, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x19d8…b802No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The contract contains instances where local variables or inherited state variables shadow existing ones, potentially leading to incorrect state updates or logic errors during execution.
Rename shadowed variables to ensure clarity and prevent accidental overwriting of critical state data.
Unresolved
The functions 'transferRemote' and 'handle' allow for the creation of new tokens. This is a standard feature of cross-chain bridges, but it means that the bridge mechanism itself has the power to increase the total supply of the token, which could dilute existing holders if the bridge security is breached.
Implement strict monitoring on the total supply and ensure the mailbox contract is secured by a robust, multi-layered security module.
Unresolved
0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x19d8…b802 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.
Check the lock's end date and beneficiary on the locker's own page before relying on it.
Acknowledged
The ten largest holders own 99.0% of supply. What remains: 59.3% in wallets, 39.6% in other contracts. 31,497 holders in total.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Nesa (NES), market cap $36M, rank #572. 31,497 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $1.0M (GeckoTerminal, all pools). 24h trading volume $11.0M (CoinGecko, all markets, daily snapshot). 24h trading volume $6.5M (GeckoTerminal, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: a ProxyAdmin contract. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $1.0M of DEX liquidity across 7 pools. Launch: 51 days of market history.
Check the project's own documentation for what the token is used for; this report covers what the contract allows.
Acknowledged
The HypERC20 contract implements an interchain token bridge using a proxy architecture. The system relies on a multisig-controlled ProxyAdmin for upgrades and administrative configuration. While the core logic follows standard cross-chain patterns, the ability to mint tokens via the bridge mechanism introduces inherent economic risks regarding supply inflation.
The architecture utilizes a robust Transparent Proxy pattern (7.1) with clear separation of concerns between the router and token logic. Code security (7.2) is high, leveraging established OpenZeppelin libraries for ERC20 and Ownable functionality. Access control (7.3) is strictly enforced via the Mailbox and ProxyAdmin, ensuring only authorized entities can trigger sensitive operations.
Economic risk (7.4) is primarily driven by the bridge's ability to mint tokens on the destination chain, which could lead to supply dilution if the bridge is compromised. Governance (7.5) is centralized under a 6-of-10 multisig, providing a strong security buffer for administrative actions. External dependencies (7.6) are limited to the underlying messaging mailbox, which is a critical point of failure.
The contract supports transparent upgrades (7.7) managed by a dedicated ProxyAdmin. Operations (7.8) are well-defined, allowing for the enrollment of new remote routers and adjustment of gas configurations. The use of a multisig for upgrades ensures that no single point of failure exists for logic changes.
Maintain the current multisig threshold and ensure that all administrative actions are subject to a time-lock if possible.
Regularly monitor the bridge's total supply across chains to detect any unauthorized minting events. Ensure that the 'handle' function's integration with the mailbox remains strictly audited, as it is the primary vector for cross-chain token minting. Consider implementing a circuit breaker or pause mechanism to halt cross-chain transfers in the event of an detected anomaly.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Nesa (NES) contract on BNB Chain is 0x097acf27503753e77bca940277806156c5925b81. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Nesa is 81/100 (High risk) as of Oct 30, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 30, 2026). Total DEX liquidity: $1.01M.
As of Oct 30, 2026, the 10 largest holders own 99.0% of the supply across 31,497 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
