On-chain security analysis — is it a scam or legit?
PolygonThe UChildERC20 contract is a standard bridge-compatible token implementation on Polygon.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 31, 2026
The 20 remaining pairs hold $552.5K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xacb1…35540x36d7…43860xbc09…a0270x6d5f…febf0x00d1…90820xbd2a…00bc0x36cc…a7410xdc61…246d0x4112…582a0x83a6…e0c2No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The contract can receive ETH through meta-transactions or direct transfers but lacks a mechanism to withdraw or transfer these funds out. Any ETH sent to the contract is permanently locked.
Implement an administrative function to withdraw any ETH accidentally sent to the contract address.
Unresolved
The deposit function allows an address with the DEPOSITOR_ROLE to mint new tokens at will. This increases the total supply and dilutes the value of existing holdings, which could be abused if the role is compromised.
Restrict the DEPOSITOR_ROLE to a highly secure, multi-signature wallet or a time-locked governance contract to prevent unauthorized minting actions.
Unresolved
The ten largest holders own 54.0% of supply. What remains: 2.5% in wallets, 51.5% in other contracts. 370,198 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Polygon Bridged WBTC (Polygon POS) (WBTC), market cap $172M. On GoPlus's list of trusted tokens. Traded on Binance. 370,198 holders. Verified by: CoinGecko, GoPlus, exchange listings.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $5.2M (DexScreener, all pools). 24h trading volume $3.7M (CoinGecko, all markets, daily snapshot). 24h trading volume $936K (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Bridged-Tokens. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $5.2M of DEX liquidity across 30 pools. Launch: 2196 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
The UChildERC20 contract is a standard bridge-compatible token implementation on Polygon. It utilizes a proxy pattern for upgradeability and standard AccessControl for administrative tasks. The primary risks identified involve centralized minting capabilities and the accumulation of trapped ETH within the contract.
The architecture follows standard OpenZeppelin-like patterns for ERC20 and AccessControl. 7.1 Architecture and 7.2 Code Security are robust, utilizing established libraries for core logic. 7.3 Access Control is correctly implemented using roles, though it grants significant power to the DEPOSITOR_ROLE. 7.6 External interactions are limited, reducing the attack surface for reentrancy or flash loan exploits.
7.4 Economic and 7.5 Governance risks are centered on the centralized minting authority. The DEPOSITOR_ROLE can arbitrarily increase the total supply, which is a necessary feature for bridge operations but introduces trust requirements. 7.8 Operations are standard for a child-chain token, relying on the bridge operator's integrity.
7.7 Upgrades are handled via a proxy pattern, allowing for logic updates. The implementation is separated from the proxy, ensuring state persistence across upgrades. The upgrade mechanism is standard and well-understood in the ecosystem.
The protocol should ensure that the address holding the DEPOSITOR_ROLE is a multi-signature wallet or a time-locked contract to mitigate the risk of unauthorized minting.
Additionally, implement a sweep function to allow the recovery of accidentally sent ETH to the contract address. Regular monitoring of the DEPOSITOR_ROLE and administrative role assignments is recommended to ensure that only authorized bridge infrastructure maintains control over the token supply.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
