Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Portal Safe?

PORTALEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades6/10Checks passed3 of 5Findings2 High · 1 Medium · 1 Low · 1 Info5
SummaryAI Copilot

The PortalToken contract is an ERC20 token leveraging OpenZeppelin extensions for permit, pausable, and burnable functionalities.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $10k
  • LP top1 unlocked holder = 87.0%
  • LP top3 unlocked holders = 95.7%
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 50% (74.1% total → 66.6% effective; 61.6% in EOAs, 12.5% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Liquidity < $10k ($5,753 across 1 pairs — easily drained)
  • LP top1 unlocked holder = 87.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 95.7% (independent LP — depth risk)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
12.5%Contracts61.6%Wallets25.9%Everyone else
12.5%61.6%Wallets25.9%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
74.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking12.5%
  • Walletsanonymous holders, free to sell61.6%
  • Everyone elsethe rest of the supply25.9%
Effective concentrationwhat the score reads66.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$5.8K

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$5.8KShare of depth100.0%
Top-1 Unlocked Holder87.0%
Top-3 Unlocked95.7%
Unlocked LP held by
0xb9a1…5d270xf667…dd150x4f8a…0bb20xf1e5…a56e0x80fb…6cf60x61c9…619e0xcd2a…6f840x6647…8f4e0x090a…da6e0x7542…116c

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 High1 Medium1 Low1 Info
High

Centralized Control by Owner

The owner role has extensive control over critical token functions, including pausing transfers (pause), enabling/disabling permit functionality (disablePermit), and setting the proxy address (setProxyAddress) which directly impacts the reported totalSupply. A compromise of the owner's private key could lead to a complete halt of token operations, manipulation of circulating supply, or disruption of user interactions.H-01

Issue

The owner role has extensive control over critical token functions, including pausing transfers (pause), enabling/disabling permit functionality (disablePermit), and setting the proxy address (setProxyAddress) which directly impacts the reported totalSupply. A compromise of the owner's private key could lead to a complete halt of token operations, manipulation of circulating supply, or disruption of user interactions.

Fix

Implement a multi-signature wallet or a time-locked contract for the owner role to introduce a delay and require multiple approvals for critical operations. This decentralizes control and reduces the risk associated with a single point of failure.

Status

Unresolved

High

Critical Dependency on External Proxy for Circulating Supply

The totalSupply() function is overridden to subtract the balance held by a proxy address, intended for cross-chain functionality. The security and integrity of the PortalToken's reported circulating supply are critically dependent on the correct functioning and security of this external proxy contract. A malicious or compromised proxy could manipulate the perceived circulating supply, leading to economic instability or misrepresentation.H-02

Issue

The totalSupply() function is overridden to subtract the balance held by a proxy address, intended for cross-chain functionality. The security and integrity of the PortalToken's reported circulating supply are critically dependent on the correct functioning and security of this external proxy contract. A malicious or compromised proxy could manipulate the perceived circulating supply, leading to economic instability or misrepresentation.

Fix

Thoroughly audit the external proxy contract to ensure its robustness and security. Implement strong access controls and monitoring for the proxy address. Clearly document the operational procedures and security model of the proxy and consider mechanisms to revoke or update the proxy address in a secure, multi-party controlled manner.

Status

Unresolved

Medium

Lack of Upgradeability

The PortalToken contract is deployed as a standard implementation without any built-in upgradeability mechanism (e.g., UUPS, Transparent proxies). This means that any future bug fixes, security patches, or feature enhancements would necessitate deploying an entirely new token contract and migrating all existing token holders, which is a complex, costly, and disruptive process.M-01

Issue

The PortalToken contract is deployed as a standard implementation without any built-in upgradeability mechanism (e.g., UUPS, Transparent proxies). This means that any future bug fixes, security patches, or feature enhancements would necessitate deploying an entirely new token contract and migrating all existing token holders, which is a complex, costly, and disruptive process.

Fix

For long-term projects, consider implementing an upgradeable proxy pattern (e.g., UUPS) to allow for future contract modifications without requiring a full token migration. If upgradeability is not desired, ensure the current implementation is extremely robust and thoroughly tested.

Status

Unresolved

Low

Owner Can Disable Permit Functionality

The disablePermit function allows the owner to enable or disable the ERC20 Permit functionality. While this is an intended feature, disabling permit could disrupt user experience or integrations that rely on gasless approvals. This power is centralized with the owner.L-01

Issue

The disablePermit function allows the owner to enable or disable the ERC20 Permit functionality. While this is an intended feature, disabling permit could disrupt user experience or integrations that rely on gasless approvals. This power is centralized with the owner.

Fix

Clearly communicate the operational policy regarding the permitEnabled state. Consider if this control needs to be managed by a multi-sig or a more decentralized mechanism if the project aims for progressive decentralization.

Status

Unresolved

Info

Reliance on Off-Chain Mitigation for Vesting Deposits

The constructor's comment states that "potential address duplication is mitigated by the deployment scripts" for vestingDeposits. This indicates a reliance on off-chain processes to ensure correct initial token distribution. While not a direct contract vulnerability, a failure in the deployment script could lead to unintended initial token allocations.I-01

Issue

The constructor's comment states that "potential address duplication is mitigated by the deployment scripts" for vestingDeposits. This indicates a reliance on off-chain processes to ensure correct initial token distribution. While not a direct contract vulnerability, a failure in the deployment script could lead to unintended initial token allocations.

Fix

Implement on-chain validation or a more robust deployment process to prevent potential issues with vestingDeposits duplication or errors, if possible. Ensure deployment scripts are thoroughly tested and reviewed.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The PortalToken contract is an ERC20 token leveraging OpenZeppelin extensions for permit, pausable, and burnable functionalities. It introduces a custom mechanism to calculate circulating supply by subtracting tokens held by a designated proxy address. The audit identified significant centralization risks due to the owner's extensive control over critical functions, and a high dependency on an external proxy contract for accurate circulating supply reporting, which could impact the token's economic stability and market perception.

Technical6/10Medium risk

The contract leverages battle-tested OpenZeppelin libraries for its core ERC20, Ownable, Permit, Pausable, and Burnable functionalities, ensuring a solid foundation (7.2 Code Security). The custom totalSupply() implementation, which subtracts tokens held by a proxy address, introduces a critical external dependency (7.1 Architecture, 7.6 External). The permit function includes an owner-controlled enable/disable switch, adding flexibility but also a point of control (7.3 Access Control).

Governance1/10High risk

The token's economic model is a straightforward ERC20 with a fixed total supply and initial distribution to vesting addresses and a treasury. However, the owner role holds highly centralized control over critical functions such as pausing transfers, disabling permit functionality, and setting the proxy address (7.5 Governance, 7.8 Operations). The circulating supply calculation's reliance on an external proxy contract introduces a significant economic risk if the proxy is compromised or mismanaged (7.4 Economic).

Upgrades6/10Medium risk

The PortalToken contract is deployed as a standard, non-upgradeable implementation (7.7 Upgrades). This design choice means that any future bug fixes, security patches, or feature enhancements would necessitate a complete redeployment of the token and a complex migration process for existing token holders. This lack of flexibility could pose challenges for long-term project evolution.

Final RecommendationWhat to do about this score

To mitigate the identified risks, it is strongly recommended to implement a multi-signature wallet or a time-locked contract for the owner role to decentralize control over critical functions like pausing, disabling permit, and setting the proxy address.

This will reduce the single point of failure risk and introduce a necessary delay for sensitive operations. Furthermore, a comprehensive security audit of the external proxy contract is crucial, along with clear documentation of its operational procedures and security model. For future flexibility, consider adopting an upgradeable proxy pattern for core contracts to allow for seamless bug fixes and feature enhancements without requiring disruptive token migrations.

Contract & Record

1 audit on record
TypePortalToken
NetworkEthereum
Token age2y
Contract0x1bbe…1fed
Deployer0x96e3…43b8
Badge for your website
Portal security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Jul 23, 202677High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

Is Portal a scam?

Based on the provided data, we cannot definitively label Portal a scam. However, it exhibits significant red flags often associated with high-risk projects. The high-risk score of 67/100, combined with unrenounced ownership, unlocked liquidity, and extreme token concentration, indicates a strong potential for investor losses due to developer action or market manipulation rather than a secure investment. Investors should proceed with extreme caution.

Is Portal safe to buy?

Portal is not considered safe to buy based on its current security profile and high-risk score of 67/100. Key risk factors include unrenounced contract ownership, allowing potential malicious changes, and unlocked liquidity, which enables a 'rug pull' by liquidity providers. The highly concentrated token supply, with 66.0% held by the top 10, also poses a significant risk of price manipulation. These factors indicate substantial investment risks.

Has Portal been audited?

The Portal token contract is verified, meaning its code is publicly available for anyone to review on the blockchain explorer. This transparency is beneficial. However, contract verification is not the same as a professional security audit. An independent security audit involves a thorough review by experts to identify vulnerabilities, logical flaws, and potential attack vectors beyond just code visibility. The provided data does not indicate that Portal has undergone such an audit.

Related Audits

6 more on the recordAll audits
NillionNIL · Ethereum77HighSynapseSYN · Ethereum76HighTurtleEthereum78HighAutonolasOLAS · Ethereum76HighSyrup TokenSYRUP · Ethereum78HighChipEthereum76High

Would You Like a More Detailed Audit of Portal?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page