On-chain security analysis — is it a scam or legit?
This audit covers the BridgeToken proxy contract, which utilizes the OpenZeppelin BeaconProxy pattern.
Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The 3 remaining pairs hold $2 between them and are not listed. The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x17a3…4463No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
BridgeToken proxy contract, which delegates its logic to an implementation contract via a Beacon. The source code for the actual implementation contract (0x5537…d904) was not provided for review. This prevents a comprehensive security assessment of the core business logic, state management, and potential vulnerabilities such as reentrancy, access control flaws, or economic exploits within the token's functionality.H-01The provided source code only includes the BridgeToken proxy contract, which delegates its logic to an implementation contract via a Beacon. The source code for the actual implementation contract () was not provided for review. This prevents a comprehensive security assessment of the core business logic, state management, and potential vulnerabilities such as reentrancy, access control flaws, or economic exploits within the token's functionality.
Provide the full source code for the implementation contract and the Beacon contract to enable a complete security audit of the entire system.
Unresolved
BridgeToken contract is a BeaconProxy, meaning its logic is entirely controlled by the implementation address set in an external Beacon contract. The administrative control over this Beacon contract determines who can upgrade the BridgeToken's logic. If the Beacon contract is controlled by a single entity or an inadequately secured address, it introduces a significant centralization risk, allowing unilateral changes to the token's behavior without community oversight.M-01The BridgeToken contract is a BeaconProxy, meaning its logic is entirely controlled by the implementation address set in an external Beacon contract. The administrative control over this Beacon contract determines who can upgrade the BridgeToken's logic. If the Beacon contract is controlled by a single entity or an inadequately secured address, it introduces a significant centralization risk, allowing unilateral changes to the token's behavior without community oversight.
Implement robust access control mechanisms for the Beacon contract, such as a multi-signature wallet with a high threshold or a time-locked governance contract, to manage implementation upgrades. This decentralizes control and introduces a delay for critical changes.
Unresolved
BridgeToken system are directly dependent on the security of the external Beacon contract. Any vulnerability or compromise in the Beacon contract could directly impact all BeaconProxy instances, including BridgeToken, by allowing unauthorized or malicious upgrades to the implementation.L-01The security and integrity of the BridgeToken system are directly dependent on the security of the external Beacon contract. Any vulnerability or compromise in the Beacon contract could directly impact all BeaconProxy instances, including BridgeToken, by allowing unauthorized or malicious upgrades to the implementation.
Conduct a thorough security audit of the Beacon contract itself, focusing on its access control, upgrade logic, and potential attack vectors. Ensure the Beacon contract is immutable or upgradeable only through secure, transparent, and decentralized governance processes.
Unresolved
BridgeToken contract correctly utilizes the BeaconProxy pattern from OpenZeppelin contracts. This pattern is a well-established and audited solution for upgradeable contracts, allowing multiple proxy instances to share the same implementation logic via a central Beacon contract. This approach saves gas and simplifies management for a set of identical upgradeable contracts.I-01The BridgeToken contract correctly utilizes the BeaconProxy pattern from OpenZeppelin contracts. This pattern is a well-established and audited solution for upgradeable contracts, allowing multiple proxy instances to share the same implementation logic via a central Beacon contract. This approach saves gas and simplifies management for a set of identical upgradeable contracts.
Continue to follow best practices for upgradeable contracts, including careful management of storage slots in the implementation to prevent storage collisions and thorough testing of all upgrade paths.
Unresolved
This audit covers the BridgeToken proxy contract, which utilizes the OpenZeppelin BeaconProxy pattern. The core logic resides in an unprovided implementation contract (0x5537857664b0f9efe38c9f320f75fef23234d904), making this a partial audit. The primary risks identified relate to the centralized control over upgrades via the associated Beacon contract, whose governance and security mechanisms are unknown.
The BridgeToken contract is a minimal proxy leveraging OpenZeppelin's BeaconProxy (7.1 Architecture). This pattern delegates all calls to an implementation contract specified by a Beacon contract. The proxy contract itself is simple and correctly imports standard OpenZeppelin libraries, suggesting good code quality (7.2 Code Security). However, the actual business logic and state management reside in the implementation contract, which was not provided for review. Therefore, a comprehensive technical security assessment (including 7.3 Access Control) cannot be completed.
The economic model (7.4 Economic) and governance mechanisms (7.5 Governance) of the BridgeToken system are primarily determined by the implementation contract and the Beacon contract. Without access to the source code or details of these components, a full assessment is not possible. The centralized control over the Beacon contract, which dictates the implementation, represents a significant governance risk as a single entity can unilaterally change the token's logic.
The BridgeToken contract uses the BeaconProxy pattern, meaning its implementation can be upgraded by changing the address stored in the associated Beacon contract (7.7 Upgrades). This provides flexibility but introduces a high upgrade risk if the Beacon's administrative control is not robustly secured, for example, by a multi-signature wallet or a time-locked governance mechanism. The current audit cannot assess the security of the Beacon contract or its upgrade permissions, leaving a critical gap in the overall upgrade safety analysis.
To ensure the overall security of the BridgeToken system, it is crucial to conduct a full audit of the implementation contract and the Beacon contract.
Special attention should be paid to the access control mechanisms governing the Beacon's ability to update the implementation address. Implement robust security measures, such as multi-signature wallets or time-locks, for any administrative roles with upgrade privileges to mitigate centralized control risks.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Velvet contract on Base is 0xbf927b841994731c573bdf09ceb0c6b0aa887cdd. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Velvet is 63/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $1.28M.
As of Sep 4, 2026, the 10 largest holders own 70.9% of the supply. The Holders section on this page shows who they are by holder type.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
