Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Superform Safe?

UPBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades7/10Checks passed3 of 5Findings1 Low · 2 Info3
SummaryAI Copilot

The audit of the UpOFT contract, an Omni-chain Fungible Token (OFT) implementation by Superform, reveals a well-structured and generally secure codebase.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-4)
  • Top-10 concentration > 70% (84.0% total → 79.2% effective; 76.0% in EOAs, 8.0% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 95% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
8.0%Contracts76.0%Wallets16.0%Everyone else
8.0%76.0%Wallets16.0%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
84.0%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking8.0%
  • Walletsanonymous holders, free to sell76.0%
  • Everyone elsethe rest of the supply16.0%
Effective concentrationwhat the score reads79.2%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$496.4K across 12 pairs
Show 4 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$472.3KShare of depth95.2%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x3b80…2013

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low2 Info
Low

Centralized Ownership (Mitigated by Multisig)

The UpOFT contract utilizes the Ownable pattern, granting a single address (the _delegate passed in the constructor) exclusive control over sensitive functions such as sweepNative and potentially other administrative functions inherited from the OFT base contract. While this pattern is common, it introduces a single point of failure if the owner's private key is compromised.L-01

Issue

The UpOFT contract utilizes the Ownable pattern, granting a single address (the _delegate passed in the constructor) exclusive control over sensitive functions such as sweepNative and potentially other administrative functions inherited from the OFT base contract. While this pattern is common, it introduces a single point of failure if the owner's private key is compromised.

Fix

The provided information indicates the owner address is a multisig with a 2/4 threshold. This significantly mitigates the risk of a single point of failure. Ensure the multisig signers are distinct, trusted individuals and that the multisig itself is securely managed through robust operational security practices.

Status

Unresolved

Info

Reliance on LayerZero Protocol Security

The UpOFT contract heavily relies on the security and correct functioning of the LayerZero v2 protocol and its endpoint. As an Omni-chain Fungible Token (OFT), its core cross-chain transfer capabilities are entirely dependent on the LayerZero infrastructure. Any vulnerabilities, misconfigurations, or operational issues within the LayerZero protocol could directly impact the UpOFT token's cross-chain functionality, integrity, and overall economic stability.I-01

Issue

The UpOFT contract heavily relies on the security and correct functioning of the LayerZero v2 protocol and its endpoint. As an Omni-chain Fungible Token (OFT), its core cross-chain transfer capabilities are entirely dependent on the LayerZero infrastructure. Any vulnerabilities, misconfigurations, or operational issues within the LayerZero protocol could directly impact the UpOFT token's cross-chain functionality, integrity, and overall economic stability.

Fix

It is crucial to continuously monitor LayerZero security announcements, audits, and operational status. Ensure that the configured _lzEndpoint address is the official, verified, and most secure endpoint for the respective network. Maintain a robust incident response plan for potential issues originating from external dependencies.

Status

Unresolved

Info

Non-Upgradeable Contract Design

The UpOFT contract is deployed as a standard, non-upgradeable contract. This design choice means that once deployed, its code cannot be modified. While this simplifies the contract's architecture and eliminates risks associated with upgrade mechanisms (e.g., proxy vulnerabilities), it also implies that any discovered bugs, security vulnerabilities, or desired feature enhancements would necessitate a complete redeployment of the contract. Such a redeployment would require users to migrate their tokens to the new contract, which can be a complex, costly, and disruptive process.I-02

Issue

The UpOFT contract is deployed as a standard, non-upgradeable contract. This design choice means that once deployed, its code cannot be modified. While this simplifies the contract's architecture and eliminates risks associated with upgrade mechanisms (e.g., proxy vulnerabilities), it also implies that any discovered bugs, security vulnerabilities, or desired feature enhancements would necessitate a complete redeployment of the contract. Such a redeployment would require users to migrate their tokens to the new contract, which can be a complex, costly, and disruptive process.

Fix

For contracts intended for long-term use or those with evolving feature sets, consider implementing an upgradeable proxy pattern (e.g., UUPS, Transparent). If immutability is a deliberate design choice, ensure thorough testing and auditing to minimize the likelihood of critical bugs, and have a clear migration strategy in place should a redeployment become necessary.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The audit of the UpOFT contract, an Omni-chain Fungible Token (OFT) implementation by Superform, reveals a well-structured and generally secure codebase. The contract inherits from LayerZero's OFT and OpenZeppelin's Ownable, providing standard cross-chain token functionality and access control. Key functions like sweepNative are properly secured with onlyOwner and robust error handling. The primary risks identified are inherent to centralized ownership (mitigated by a multisig) and reliance on external protocols like LayerZero. The contract is not upgradeable, which implies a higher operational risk for bug fixes or feature enhancements.

Technical8/10Low risk

The UpOFT contract demonstrates strong technical security. It correctly inherits from LayerZero's OFT and OpenZeppelin's Ownable, ensuring standard and audited base functionalities (7.1 Architecture). The constructor includes a necessary check for a valid LayerZero endpoint address, preventing deployment with a zero address. The sweepNative function, designed to recover accidentally sent native tokens, is secured with onlyOwner and uses a low-level call with a success check, effectively preventing reentrancy and ensuring robust error handling (7.2 Code Security). Access control is appropriately enforced via the onlyOwner modifier for administrative functions (7.3 Access Control).

Governance1/10High risk

The contract's governance model relies on the Ownable pattern, where a single address (the _delegate from the constructor) holds administrative control (7.5 Governance). This centralized control is mitigated by the owner being a multisig wallet, reducing the risk of a single point of failure. Economically, the contract's primary function as an OFT means its value and cross-chain functionality are directly tied to the security and operational integrity of the underlying LayerZero v2 protocol (7.4 Economic). Any issues with LayerZero's messaging or bridging mechanisms could impact the token's utility and value (7.6 External).

Upgrades7/10Low risk

The UpOFT contract is not designed to be upgradeable (7.7 Upgrades). This design choice simplifies the contract's architecture and reduces the attack surface associated with proxy patterns. However, it also means that any discovered vulnerabilities, critical bugs, or desired feature enhancements would necessitate a complete redeployment of the contract and a migration of assets, which can be a complex and costly operational undertaking (7.8 Operations).

Final RecommendationWhat to do about this score

It is recommended to ensure the multisig wallet controlling the contract's ownership is robustly secured, with geographically distributed and trusted signers.

Continuous monitoring of the LayerZero v2 protocol for security updates and announcements is crucial due to the contract's inherent dependency. For future contracts, consider the trade-offs of upgradeability versus immutability, especially for core components that may require long-term maintenance or feature evolution.

Contract & Record

1 audit on record
TypeSolidity 0.8.30
NetworkBase
Token age1y
Contract0x5b21…c86b
Deployer0x6e3d…8df8
Badge for your website
Superform security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202647Medium
  2. Aug 17, 202645Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the UP contract address?

The Superform (UP) contract on Base is 0x5b2193fdc451c1f847be09ca9d13a4bf60f8c86b. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Superform a scam?

Quantum Audit's risk score for Superform is 47/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is UP liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $496.4K.

Who holds UP?

As of Sep 4, 2026, the 10 largest holders own 84.0% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
ViciCoinVCNT · Base47MediumgitlawbBase47MediumWrapped liquid staked Ether 2.0WSTETH · Base47MediumiStonksBase47MediumaeonBase46MediumCoinbase Wrapped Staked ETHCBETH · Base48Medium

Would You Like a More Detailed Audit of Superform?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page