Quantum Audit Logo

Is Wrapped Coinbase Global Inc ST0x Safe?

On-chain security analysis — is it a scam or legit?

Wrapped Coinbase Global Inc ST0x WTCOIN
0x5cda…2204
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The StoxWrappedTokenVault contract serves as an upgradeable ERC-4626 vault implementation for a BeaconProxy. The contract leverages well-audited OpenZeppelin libraries, ensuring a solid foundation for its core vault functionalities. Key strengths include proper upgradeability patterns and basic input validation. Identified issues primarily relate to potential incompatibilities with certain ERC-20 token types and critical initialization parameter handling, leading to a Medium overall risk level.

1 Medium1 Low1 Informational
Volume 24h
$557.8K
Liquidity
$39.8K
Price
$192.4400
Token Age
1y
Top 10 Holders
86.7%

Security Findings

1 Med1 Low1 Info
Medium

Incompatibility with Fee-on-Transfer or Rebasing Tokens

M-01The StoxWrappedTokenVault, as an ERC-4626 vault, does not explicitly handle fee-on-transfer or rebasing ERC-20 tokens. If the underlying `asset` token charges fees on transfers (e.g., during deposits or withdrawals) or has a rebasing mechanism, the vault's internal accounting (specifically `totalAssets()`) may not accurately reflect the actual amount of underlying tokens held. This discrepancy can lead to incorrect share prices, loss of funds for users, or denial of service for certain operations.
IssueThe StoxWrappedTokenVault, as an ERC-4626 vault, does not explicitly handle fee-on-transfer or rebasing ERC-20 tokens. If the underlying `asset` token charges fees on transfers (e.g., during deposits or withdrawals) or has a rebasing mechanism, the vault's internal accounting (specifically `totalAssets()`) may not accurately reflect the actual amount of underlying tokens held. This discrepancy can lead to incorrect share prices, loss of funds for users, or denial of service for certain operations.
FixBefore deploying with a specific asset, verify that the underlying ERC-20 token is a standard, non-rebasing, non-fee-on-transfer token. If such tokens must be supported, consider implementing custom `_deposit`, `_withdraw`, `_mint`, and `_redeem` hooks to account for token mechanics, or use a wrapper that normalizes the token's behavior.
StatusUnresolved
Low

Critical Initialization Parameter (Asset Address)

L-01The `initialize` function decodes the `asset` address from `bytes calldata data`. While this pattern is common for factory-deployed clones, it makes the correct functioning of the vault entirely dependent on the accuracy of the `data` provided during the proxy's initialization. An incorrect or malicious `asset` address supplied during the initial deployment and initialization of the BeaconProxy could render the vault unusable or link it to an unintended or exploitable token.
IssueThe `initialize` function decodes the `asset` address from `bytes calldata data`. While this pattern is common for factory-deployed clones, it makes the correct functioning of the vault entirely dependent on the accuracy of the `data` provided during the proxy's initialization. An incorrect or malicious `asset` address supplied during the initial deployment and initialization of the BeaconProxy could render the vault unusable or link it to an unintended or exploitable token.
FixImplement stringent checks and multi-party verification processes for the `data` parameter used during the BeaconProxy's initialization. Ensure that the `asset` address is thoroughly vetted and confirmed to be the intended token before deployment. Consider adding a mechanism to allow the Beacon owner to pause the vault or change the asset if a misconfiguration is detected, although this would add complexity.
StatusUnresolved
Info

Redundant `__ERC20_init` Call

I-01The `initialize` function includes a call to `__ERC20_init("", "")`, which sets the ERC-20 name and symbol of the shares token to empty strings. However, the contract immediately overrides the `name()` and `symbol()` functions to derive these values from the underlying asset. Consequently, the `__ERC20_init` call is redundant as its effects are immediately superseded by the overrides.
IssueThe `initialize` function includes a call to `__ERC20_init("", "")`, which sets the ERC-20 name and symbol of the shares token to empty strings. However, the contract immediately overrides the `name()` and `symbol()` functions to derive these values from the underlying asset. Consequently, the `__ERC20_init` call is redundant as its effects are immediately superseded by the overrides.
FixThe `__ERC20_init("", "")` call can be safely removed from the `initialize` function without affecting the contract's functionality or security, potentially saving a small amount of gas during initialization.
StatusUnresolved

Category Ratings

TechnicalLow7/10

The contract exhibits good technical security, primarily due to its reliance on OpenZeppelin's battle-tested ERC4626Upgradeable library (7.2 Code Security). The custom logic is minimal, focusing on initialization and token metadata overrides, which are implemented correctly. Input validation for the asset address (e.g., `ZeroAsset()` check) is present, enhancing robustness (7.2 Code Security). External calls to the underlying asset's `name()` and `symbol()` functions are for view-only data, posing minimal reentrancy risk (7.6 External).

GovernanceHigh2/10

The primary economic risk (7.4 Economic) stems from the vault's potential incompatibility with non-standard ERC-20 tokens, such as fee-on-transfer or rebasing tokens, which could lead to accounting discrepancies and user losses. The contract itself lacks internal governance mechanisms (7.5 Governance), relying entirely on the BeaconProxy's owner for any operational changes or upgrades. This centralizes control, which is typical for such a vault but means the security of the system is highly dependent on the Beacon owner's security practices (7.3 Access Control).

UpgradesHigh1/10

The contract is designed as an upgradeable implementation for a BeaconProxy, correctly utilizing OpenZeppelin's `Initializable` pattern (7.7 Upgrades). The `_disableInitializers()` in the constructor prevents direct initialization of the implementation, and the `initialize` function uses the `initializer` modifier, ensuring it can only be called once by the proxy. This architecture allows for secure and controlled upgrades of the vault's logic via the Beacon (7.1 Architecture).

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership Renounced?
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Proxy Upgrade Controls

Proxy TypeBeacon
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

86.7% in top 10
3.6% in wallets83.1% in contracts
Effective Concentration36.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$154.1K across 15 pairs
Uniswap v4USDCanalysed$39.8K25.8%Uniswap v4USDC$34.2K22.2%Hydrex CLAMMUSDC$34.0K22.1%AerodromeUSDC$29.7K19.3%Uniswap v3WETH$11.7K7.6%Uniswap v4USDC$3.7K2.4%
Show 4 more pairsShow less
Uniswap v4USDC$6330.4%Uniswap v4ETH$980.1%Uniswap v4USDC$780.1%Uniswap v4USDC$690.0%

The 5 remaining pairs hold $169 between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0x691a…4451
Unlocked LP Held By
0x06cf…c7790x337c…9a2f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

11 factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Complex proxy pattern (BEACON)
  • Top-10 concentration > 30% (86.7% total → 36.8% effective; 3.6% in EOAs, 83.1% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10× (14.0× — possible wash trading)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 26% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 26% of DEX liquidity)
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Morpho Token (MORPHO)High RiskTether USD (USDT)High RiskOMI Token (OMI)High RiskevoHigh RiskSilencio (SLC)High RiskBIOHigh Risk

Would You Like a More Detailed Audit of Wrapped Coinbase Global Inc ST0x?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit