On-chain security analysis — is it a scam or legit?
The protocol implements a standard Arbitrum L2 gateway token pattern using a beacon proxy architecture.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
How the supply is spread across holders could not be read — the indexer's holder list does not add up to the supply. The indexer lists 104.6% of the supply in its top 10, which cannot be right. Check the largest holders on a block explorer, which reads current balances.
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x2537…dfab0x73e5…91adNo privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
Liquidity $271K (GeckoTerminal, all pools). 24h trading volume $1.9M (CoinGecko, all markets, daily snapshot). 24h trading volume $36K (GeckoTerminal, all pools). CoinGecko's record for this coin: all-time high $1.78 on 2021-11-15; the price is now 99.455% below it.
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The bridgeMint function allows the authorized gateway address to increase the total supply of the token at any time, which can lead to the dilution of existing token holders' value.
Ensure the gateway contract is governed by a secure, multi-signature wallet or a decentralized governance process to prevent unauthorized minting.
Unresolved
The bridgeBurn function allows the authorized gateway address to directly remove tokens from any user's balance, effectively granting the gateway controller the ability to seize or destroy user funds.
Implement strict timelocks or multi-signature requirements for any actions that involve burning tokens from user addresses to prevent potential abuse.
Unresolved
The holder list from the security indexer adds up to 104.6% of supply, so it does not describe real balances. That happens with rebasing and reflection tokens, whose balances change without transfers, and with contracts that report balances they do not hold. Concentration is unknown and priced as an unknown — neither a whale nor safe.
Check the largest holders on the block explorer, which reads current balances.
Acknowledged
Listed on CoinGecko as WOO (WOO), market cap $18M, rank #887. On GoPlus's list of trusted tokens. Traded on Binance. 49,798 holders. Verified by: CoinGecko, GoPlus, exchange listings.
Match the contract address against the project's official channels before trading.
Acknowledged
A token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Basis: a copy of the coin from its home chain (ethereum), minted here by the chain's standard bridge (bridgeMint). Tokenomics — Supply: minted here by the chain's standard bridge (bridgeMint) against tokens locked or burned on other chains. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $271K of DEX liquidity across 20 pools. Launch: 1462 days of market history.
The backing is the risk: check who holds the underlying asset and how redemption works.
Acknowledged
The protocol implements a standard Arbitrum L2 gateway token pattern using a beacon proxy architecture. The contract relies on external gateway contracts to manage minting and burning operations. While the implementation follows established L2 standards, the centralization of power within the gateway contract poses a significant risk to token holders.
The architecture utilizes a standard beacon proxy pattern, ensuring consistent implementation across clones (7.1 Architecture). Code security is high, leveraging audited OpenZeppelin upgradeable libraries (7.2 Code Security). Access control is strictly enforced via the onlyGateway modifier, limiting privileged actions to authorized bridge contracts (7.3 Access Control).
Economic stability is maintained by the bridge gateway, which acts as the sole source of truth for supply (7.4 Economic). Governance is currently centralized within the bridge infrastructure, lacking decentralized oversight for minting/burning (7.5 Governance). External dependencies on the L2 gateway are critical, as any compromise of the gateway contract directly impacts token integrity (7.6 External).
The protocol uses a beacon proxy pattern, allowing for efficient upgrades across multiple instances (7.7 Upgrades). Operational security is maintained through standard proxy management practices (7.8 Operations). The upgrade mechanism is well-understood and follows industry best practices for upgradeable contracts.
Token holders should be aware that the bridge gateway contract holds absolute authority over token supply and individual balances.
It is recommended to monitor the gateway contract for any administrative changes or security updates. Ensure that the multisig or governance mechanism controlling the bridge gateway is robust, as this is the single point of failure for the entire token ecosystem.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
The Wootrade Network (WOO) contract on Arbitrum is 0xcafcd85d8ca7ad1e1c6f82f651fa15e33aefd07b. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.
Quantum Audit's risk score for Wootrade Network is 17/100 (Low risk) as of Oct 30, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.
Liquidity lock: Not locked (as of Oct 30, 2026). Total DEX liquidity: $270.8K.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Add your links and get it Verified
