Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is PORTAL Safe?

Base
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance4/10Upgrades7/10Checks passed3 of 5Findings1 Low · 2 Info3
SummaryAI Copilot

This report details the security audit of the ERC20FixedSupply token contract.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 30% (99.9% total → 40.3% effective; 0.6% in EOAs, 99.3% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 84% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 84% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
99.3%Contracts
99.3%Contracts
ContractsWalletsEveryone elseBubble area = share of supply
99.9%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking99.3%
  • Walletsanonymous holders, free to sell0.6%
  • Everyone elsethe rest of the supply0.1%
Effective concentrationwhat the score reads40.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$89.4K across 3 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$74.7KShare of depth83.5%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0xb5a6…b002

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low2 Info
Low

Centralization Risk with Owner Privileges

The contract owner, despite being a multisig, retains significant control over certain administrative functions. For instance, the owner can transfer ownership of the contract and utilize the TokenRecovery mechanism to recover accidentally sent ERC20 tokens. While a multisig mitigates single points of failure, the concentration of these powers still represents a centralization risk if the multisig signers are compromised or act maliciously.L-01

Issue

The contract owner, despite being a multisig, retains significant control over certain administrative functions. For instance, the owner can transfer ownership of the contract and utilize the TokenRecovery mechanism to recover accidentally sent ERC20 tokens. While a multisig mitigates single points of failure, the concentration of these powers still represents a centralization risk if the multisig signers are compromised or act maliciously.

Fix

Ensure the multisig signers are highly trusted individuals or entities with robust security practices. Implement strict internal governance procedures for multisig operations. Consider time-locks or additional approval steps for critical actions like transferOwnership if the protocol's future evolution requires more decentralized control.

Status

Unresolved

Info

Dependency on External Forwarder Registry

The contract relies on an external IForwarderRegistry for its meta-transaction functionality, specifically for overriding _msgSender() and _msgData(). The security, liveness, and immutability of this external registry are critical for the proper functioning and security of meta-transactions within the ERC20FixedSupply contract. A compromise or malfunction in the IForwarderRegistry could disrupt meta-transaction services.I-01

Issue

The contract relies on an external IForwarderRegistry for its meta-transaction functionality, specifically for overriding _msgSender() and _msgData(). The security, liveness, and immutability of this external registry are critical for the proper functioning and security of meta-transactions within the ERC20FixedSupply contract. A compromise or malfunction in the IForwarderRegistry could disrupt meta-transaction services.

Fix

Thoroughly audit the IForwarderRegistry contract and ensure it is deployed by a trusted entity and maintained securely. Monitor its operational status and any potential upgrade paths. Document the expected behavior and security assumptions related to this external dependency.

Status

Unresolved

Info

Criticality of Initial Token Distribution

The entire fixed supply of tokens is minted and distributed during the contract's constructor via the batchMint function. This is a one-time, irreversible operation. Any errors in the holders addresses or allocations amounts provided during deployment would lead to an incorrect or unfair initial distribution of the token supply, which cannot be rectified post-deployment.I-02

Issue

The entire fixed supply of tokens is minted and distributed during the contract's constructor via the batchMint function. This is a one-time, irreversible operation. Any errors in the holders addresses or allocations amounts provided during deployment would lead to an incorrect or unfair initial distribution of the token supply, which cannot be rectified post-deployment.

Fix

Implement rigorous pre-deployment checks and simulations for the holders and allocations arrays. Conduct multiple reviews of the deployment script and parameters by independent parties. Consider a dry-run deployment on a testnet with the exact parameters intended for mainnet to verify the outcome.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This report details the security audit of the ERC20FixedSupply token contract. The contract implements a standard fixed-supply ERC20 token with features like meta-transactions, batch transfers, and token recovery. Ownership is managed by a multisig, enhancing security. The contract exhibits a robust architecture and good coding practices, with identified risks primarily informational or low-severity concerning operational aspects and external dependencies.

Technical10/10Low risk

The contract exhibits a robust technical architecture, leveraging well-tested OpenZeppelin components and a modular design with dedicated storage libraries (7.1 Architecture). Solidity 0.8.28 is used, mitigating common integer issues, and ERC20SafeTransfers ensures secure token operations (7.2 Code Security). Meta-transaction support via ForwarderRegistryContext is a valuable feature, enhancing user experience. The primary technical consideration is the reliance on the external IForwarderRegistry for meta-transaction functionality (7.6 External), whose security is paramount.

Governance4/10Medium risk

The economic model is straightforward, featuring a fixed supply token minted entirely during deployment, preventing future inflation (7.4 Economic). Access control is robust, with contract ownership managed by a 3/5 multisig, significantly reducing single points of failure and enhancing operational security (7.3 Access Control, 7.5 Governance, 7.8 Operations). The TokenRecovery mechanism provides a safeguard for accidentally sent *other* ERC20 tokens to the contract address (7.8 Operations).

Upgrades7/10Low risk

The ERC20FixedSupply contract is not designed as an upgradeable proxy, as indicated by the is_proxy: false flag in the provided information (7.7 Upgrades). This design choice simplifies the contract's lifecycle and inherently removes upgrade-related risks such as storage collisions, reinitialization vulnerabilities, or faulty upgrade logic. Any changes to the contract's logic would necessitate a new deployment and a migration process.

Final RecommendationWhat to do about this score

Ensure the IForwarderRegistry contract, an external dependency for meta-transaction functionality, is thoroughly audited and maintained to prevent any cascading security issues.

Meticulously verify the holders and allocations arrays during deployment to prevent irreversible errors in the initial token distribution, as this is a critical, one-time operation. Consider the trade-offs of implementing a pause mechanism for emergency situations, weighing it against the simplicity and immutability expected of a fixed-supply token.

Contract & Record

1 audit on record
TypeToken
NetworkBase
Token age1y
Contract0x0ffe…cb2d
Deployer0x057f…e355
Badge for your website
PORTAL security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 17, 202629Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the PORTAL contract address?

The PORTAL contract on Base is 0x0ffebc403f2d3dd9ea5501ca03916e98967acb2d. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is PORTAL a scam?

Quantum Audit's risk score for PORTAL is 29/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is PORTAL liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $89.4K.

Who holds PORTAL?

As of Sep 4, 2026, the 10 largest holders own 99.9% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
BaselineBase29LowboarBase29LowCoinbase ManBRIAN · Base30LowtobyBase30LowMeta Platforms Inc.METAC · Base28LowOlivia AI 2.0$OLIVIA2.0 · Base28Low

Would You Like a More Detailed Audit of PORTAL?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page