On-chain security analysis — is it a scam or legit?
The OptimismMintableERC20 contract is a standard ERC20 token designed for cross-chain bridging.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x729d…9f35No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
OptimismMintableERC20 token's security is highly dependent on the security of the BRIDGE contract, which has exclusive control over minting and burning via the onlyBridge modifier. A compromise of the BRIDGE would directly impact the token's integrity by allowing unauthorized supply manipulation. This is an inherent design characteristic of a bridged token, not a flaw in this specific contract, but it represents a significant external risk (7.6 External).L-01The OptimismMintableERC20 token's security is highly dependent on the security of the BRIDGE contract, which has exclusive control over minting and burning via the onlyBridge modifier. A compromise of the BRIDGE would directly impact the token's integrity by allowing unauthorized supply manipulation. This is an inherent design characteristic of a bridged token, not a flaw in this specific contract, but it represents a significant external risk (7.6 External).
Ensure the BRIDGE contract undergoes rigorous security audits and maintains robust operational security. Implement comprehensive monitoring for the BRIDGE contract's activities and consider multi-signature or time-lock mechanisms for critical operations.
Unresolved
REMOTE_TOKEN, BRIDGE, and DECIMALS are declared as immutable and set during construction. This prevents any post-deployment modification, enhancing the contract's security and predictability (7.1 Architecture).I-01Key parameters such as REMOTE_TOKEN, BRIDGE, and DECIMALS are declared as immutable and set during construction. This prevents any post-deployment modification, enhancing the contract's security and predictability (7.1 Architecture).
No action required; this is a good security practice already implemented.
Resolved
supportsInterface function, ensuring compatibility within the ecosystem. It also utilizes battle-tested OpenZeppelin libraries for core ERC20 functionality, reducing the likelihood of common vulnerabilities (7.2 Code Security).I-02The contract correctly implements ERC20 and ERC165 standards, including the supportsInterface function, ensuring compatibility within the ecosystem. It also utilizes battle-tested OpenZeppelin libraries for core ERC20 functionality, reducing the likelihood of common vulnerabilities (7.2 Code Security).
No action required; this is a good security practice already implemented.
Resolved
The OptimismMintableERC20 contract is a standard ERC20 token designed for cross-chain bridging. The code is well-structured, utilizes OpenZeppelin libraries, and correctly implements access control for critical minting and burning functions. The primary risk lies in the external dependency on the BRIDGE contract, which controls token supply.
The technical implementation of the OptimismMintableERC20 contract is robust. It leverages battle-tested OpenZeppelin libraries for ERC20 functionality and Solidity 0.8.15, mitigating common vulnerabilities like integer overflows. Critical parameters such as BRIDGE and REMOTE_TOKEN are immutable, preventing unauthorized changes (7.1 Architecture). Access control for mint and burn functions is strictly enforced via the onlyBridge modifier, ensuring only the designated bridge can modify token supply (7.3 Access Control).
The economic security of the OptimismMintableERC20 token is primarily dependent on the security and operational integrity of the external BRIDGE contract. The BRIDGE contract holds exclusive power to mint and burn tokens, making it a central point of control (7.4 Economic). While this design is inherent to cross-chain bridged tokens, a compromise of the BRIDGE could lead to unauthorized token supply manipulation. There is no on-chain governance mechanism within this specific contract (7.5 Governance).
The OptimismMintableERC20 contract is not designed to be upgradeable. It does not implement any proxy patterns (e.g., UUPS, Transparent) or upgradeability mechanisms (7.7 Upgrades). This eliminates risks associated with upgradeability, such as proxy storage collisions or faulty upgrade logic.
It is recommended to conduct a thorough audit of the external BRIDGE contract, as its security directly impacts the integrity of this token.
Implement robust monitoring for the BRIDGE contract's operations and ensure multi-signature or time-lock mechanisms are in place for critical administrative actions on the bridge. Maintain strong operational security practices for all keys controlling the BRIDGE.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
