On-chain security analysis — is it a scam or legit?
EthereumThe TBTC contract is a standard ERC-20 implementation with additional recovery and minting capabilities.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 31, 2026
The 6 remaining pairs hold $6.6K between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the checked pool, Uniswap v3, are not locked or burned, so whoever holds them can withdraw that liquidity. The LP of the deepest pool (17.8% of depth) could not be read, so whether it is locked is unknown.
0x310d…73ea0x01a6…d99a0x5f37…9e200xc450…ec5dNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
The mint(address,uint256) function allows the contract owner to create new tokens at will, which increases the total supply and dilutes the value of existing holdings.
Restrict the minting capability to a multi-signature wallet or implement a timelock mechanism to ensure that any increase in supply is subject to community oversight or a mandatory waiting period.
Unresolved
The ten largest holders own 79.7% of supply. What remains: 7.0% in wallets, 72.7% in other contracts. 24,882 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as tBTC (TBTC), market cap $324M. 24,882 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $23.5M (DexScreener, all pools). 24h trading volume $6.2M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.8M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: CoinGecko category: Tokenized BTC. Tokenomics — Supply: mintable with no on-chain cap found. Control: a ProxyAdmin contract. Code: not upgradeable (no proxy). Fees: no buy or sell tax. Market: $23.5M of DEX liquidity across 16 pools. Launch: 1367 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
The TBTC contract is a standard ERC-20 implementation with additional recovery and minting capabilities. The architecture is straightforward, utilizing OpenZeppelin standards for core functionality. While the owner possesses significant power to mint tokens and recover assets, these functions are typical for administrative management in this token model.
The contract follows established ERC-20 standards and includes safe transfer patterns. 7.1 Architecture is modular, 7.2 Code Security is robust due to the use of audited libraries, and 7.3 Access Control is strictly enforced via Ownable. 7.6 External interactions are limited to safe transfers, minimizing reentrancy risks.
7.4 Economic and 7.5 Governance rely on a centralized owner address. The ability to mint tokens creates a potential for supply inflation, which is a significant economic risk for holders. Governance is currently limited to the owner, necessitating trust in the administrative entity.
7.7 Upgrades are not supported as the contract is not a proxy. 7.8 Operations are handled through standard administrative functions. The lack of upgradeability ensures immutability of the current logic.
The protocol should consider transitioning the owner role to a multi-signature wallet or a decentralized governance contract to mitigate the risk of centralized control over token supply.
Additionally, implementing a timelock on the mint function would provide transparency and protection for token holders against sudden supply changes.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The tBTC v2 (TBTC) contract on Ethereum is 0x18084fba666a33d37592fa2633fd49a74dd93a88. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for tBTC v2 is 9/100 (Low risk) as of Oct 31, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 31, 2026). Total DEX liquidity: $23.50M.
As of Oct 31, 2026, the 10 largest holders own 79.7% of the supply across 24,882 holders. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
