Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Prompt Safe?

PROMPTEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 25, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance4/10Upgrades4/10Checks passed4 of 7Findings2 Medium · 4 Info6
SummaryAI Copilot

PromptToken is an ERC-20 compliant token integrated with LayerZero's OFT (Omnichain Fungible Token) standard.

Read the full analysis
What raised the score
  • Mintable supply — no cap found, dilution unbounded; held by endpoint: Other-Contract
  • Liquidity not locked
  • Top-10 concentration > 30%
Exact factors
  • Mintable supply — no cap found, dilution unbounded; held by endpoint: Other-Contract
  • Liquidity NOT locked (100% of the pool) — held by independent providers — market-depth risk
  • Top-10 concentration > 30% (83.2% total → 39.1% effective; 9.7% in EOAs, 73.5% in contracts)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 254 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 25, 20267,387 holders
73.5%Contracts9.7%Wallets16.8%Everyone else
73.5%Contracts9.7%16.8%
ContractsWalletsEveryone elseBubble area = share of supply
83.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking73.5%
  • Walletsanonymous holders, free to sell9.7%
  • Everyone else7,377 holders16.8%
Effective concentrationwhat the score reads39.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 25, 2026

Liquidity

as of audit · Oct 25$218.4K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$218.4KShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x2751…5bdf0xf78d…086e0x7676…2b310xafda…0d160x347d…098a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 Medium4 Info
Medium

Privileged Minting via Cross-Chain Messaging

The functions send, lzReceiveSimulate, and lzReceive allow for the minting of new tokens as part of the cross-chain transfer process. While this is intended for the OFT standard, it effectively allows the LayerZero endpoint to increase the total supply of the token, which could dilute existing holders if the endpoint or messaging protocol were compromised.CP-01

Issue

The functions send, lzReceiveSimulate, and lzReceive allow for the minting of new tokens as part of the cross-chain transfer process. While this is intended for the OFT standard, it effectively allows the LayerZero endpoint to increase the total supply of the token, which could dilute existing holders if the endpoint or messaging protocol were compromised.

Fix

Ensure that the LayerZero endpoint is trusted and that the cross-chain messaging parameters are strictly configured. Implement monitoring to alert on large minting events that deviate from expected cross-chain volume.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x2751…5bdf — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a wallet, 0x2751…5bdf — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Info

Who holds the supply

The ten largest holders own 83.2% of supply. What remains: 9.7% in wallets, 73.5% in other contracts. The deployer/owner wallet itself holds 15.1%. 7,387 holders in total.QA-HOLDERS

Issue

The ten largest holders own 83.2% of supply. What remains: 9.7% in wallets, 73.5% in other contracts. The deployer/owner wallet itself holds 15.1%. 7,387 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Listed, but not independently verified

Listed on CoinGecko as Wayfinder (PROMPT), market cap $4M, rank #1835. 7,387 holders.QA-IDENTITY

Issue

Listed on CoinGecko as Wayfinder (PROMPT), market cap $4M, rank #1835. 7,387 holders.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

The market for this token

Liquidity $218K (DexScreener, all pools). 24h trading volume $4.1M (CoinGecko, all markets, daily snapshot). 24h trading volume $273K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.607 on 2025-04-12; the price is now 97.2193% below it.QA-MARKET

Issue

Liquidity $218K (DexScreener, all pools). 24h trading volume $4.1M (CoinGecko, all markets, daily snapshot). 24h trading volume $273K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.607 on 2025-04-12; the price is now 97.2193% below it.

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-6 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $218K of DEX liquidity across 2 pools. Launch: 562 days of market history.QA-PROFILE

Issue

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-6 multisig. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $218K of DEX liquidity across 2 pools. Launch: 562 days of market history.

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 25
Executive SummaryWhat the contract is and what the review found

PromptToken is an ERC-20 compliant token integrated with LayerZero's OFT (Omnichain Fungible Token) standard. The contract utilizes AccessControl for granular permission management and includes custom logic for Wayfinder gateway integration. The primary risk identified involves the minting capabilities inherent to the cross-chain messaging architecture, which is standard for OFT implementations but requires careful monitoring of the endpoint configuration.

Technical8/10Low risk

The architecture follows standard OpenZeppelin and LayerZero patterns, ensuring robust ERC-20 and OFT compliance. 7.1 Architecture is modular, separating cross-chain logic from core token state. 7.2 Code Security is high, utilizing ReentrancyGuard and standard library implementations. 7.3 Access Control is strictly enforced via roles and ownership, though 7.6 External dependencies on the LayerZero endpoint are critical to system integrity.

Governance4/10Medium risk

7.4 Economic and 7.5 Governance risks are centered on the ability of privileged roles to modify gateway configurations and cross-chain parameters. While the multisig owner provides a layer of protection, the capacity to mint tokens via cross-chain messages necessitates high trust in the endpoint security. 7.8 Operations are supported by clear role-based access, preventing single-point-of-failure for configuration changes.

Upgrades4/10Medium risk

7.7 Upgrades are not currently implemented as the contract is not a proxy. The immutability of the logic provides security against unauthorized code changes. Future upgrades would require a migration strategy, as the current architecture is fixed.

Final RecommendationWhat to do about this score

Maintain the current multisig threshold for all privileged roles and ensure that the LayerZero endpoint address is monitored for any unauthorized configuration changes.

Regularly audit the list of addresses granted the INVOKE_WAYFINDER_CONFIGURATION_ROLE to ensure adherence to the principle of least privilege. Monitor cross-chain activity logs to detect any anomalous minting patterns that could indicate a compromise of the messaging endpoint. Ensure that the owner multisig remains active and that key management practices are strictly followed.

Contract & Record

1 audit on record
TypePromptToken
NetworkEthereum
Token age1y
Contract0x28d3…1544
Deployer0x42aa…2ddf
Badge for your website
Prompt security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Oct 25, 202650Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the PROMPT contract address?

The Prompt contract on Ethereum is 0x28d38df637db75533bd3f71426f3410a82041544. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Prompt a scam?

Quantum Audit's risk score for Prompt is 50/100 (Medium risk) as of Oct 25, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is PROMPT liquidity locked?

Liquidity lock: Not locked (as of Oct 25, 2026). Total DEX liquidity: $218.4K.

Who holds PROMPT?

As of Oct 25, 2026, the 10 largest holders own 83.2% of the supply across 7,387 holders. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
EthenaENA · Ethereum50MediumUniswapUNI · Ethereum50MediumEigenCloud (prev. EigenLayer)EIGEN · Ethereum50MediumYield BasisYB · Ethereum50MediumOlympusOHM · Ethereum50MediumUSDeEthereum50Medium

Would You Like a More Detailed Audit of Prompt?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page