Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Wrapped Coinbase Global Inc ST0x Safe?

WTCOINBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance2/10Upgrades1/10Checks passed3 of 7Findings1 Medium · 1 Low · 1 Info3
SummaryAI Copilot

The StoxWrappedTokenVault contract serves as an upgradeable ERC-4626 vault implementation for a BeaconProxy.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Complex proxy pattern
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10×
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Complex proxy pattern (BEACON)
  • Top-10 concentration > 30% (86.7% total → 36.8% effective; 3.6% in EOAs, 83.1% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • Volume/Liquidity > 10× (14.0× — possible wash trading)
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 26% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 26% of DEX liquidity)
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
83.1%Contracts3.6%13.3%Everyone else
83.1%Contracts13.3%
ContractsWalletsEveryone elseBubble area = share of supply
86.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking83.1%
  • Walletsanonymous holders, free to sell3.6%
  • Everyone elsethe rest of the supply13.3%
Effective concentrationwhat the score reads36.8%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$154.1K across 15 pairs
Show 4 more pairs

The 5 remaining pairs hold $169 between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$39.8KShare of depth25.8%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x06cf…c7790x337c…9a2f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Medium1 Low1 Info
Medium

Incompatibility with Fee-on-Transfer or Rebasing Tokens

The StoxWrappedTokenVault, as an ERC-4626 vault, does not explicitly handle fee-on-transfer or rebasing ERC-20 tokens. If the underlying asset token charges fees on transfers (e.g., during deposits or withdrawals) or has a rebasing mechanism, the vault's internal accounting (specifically totalAssets()) may not accurately reflect the actual amount of underlying tokens held. This discrepancy can lead to incorrect share prices, loss of funds for users, or denial of service for certain operations.M-01

Issue

The StoxWrappedTokenVault, as an ERC-4626 vault, does not explicitly handle fee-on-transfer or rebasing ERC-20 tokens. If the underlying asset token charges fees on transfers (e.g., during deposits or withdrawals) or has a rebasing mechanism, the vault's internal accounting (specifically totalAssets()) may not accurately reflect the actual amount of underlying tokens held. This discrepancy can lead to incorrect share prices, loss of funds for users, or denial of service for certain operations.

Fix

Before deploying with a specific asset, verify that the underlying ERC-20 token is a standard, non-rebasing, non-fee-on-transfer token. If such tokens must be supported, consider implementing custom _deposit, _withdraw, _mint, and _redeem hooks to account for token mechanics, or use a wrapper that normalizes the token's behavior.

Status

Unresolved

Low

Critical Initialization Parameter (Asset Address)

The initialize function decodes the asset address from bytes calldata data. While this pattern is common for factory-deployed clones, it makes the correct functioning of the vault entirely dependent on the accuracy of the data provided during the proxy's initialization. An incorrect or malicious asset address supplied during the initial deployment and initialization of the BeaconProxy could render the vault unusable or link it to an unintended or exploitable token.L-01

Issue

The initialize function decodes the asset address from bytes calldata data. While this pattern is common for factory-deployed clones, it makes the correct functioning of the vault entirely dependent on the accuracy of the data provided during the proxy's initialization. An incorrect or malicious asset address supplied during the initial deployment and initialization of the BeaconProxy could render the vault unusable or link it to an unintended or exploitable token.

Fix

Implement stringent checks and multi-party verification processes for the data parameter used during the BeaconProxy's initialization. Ensure that the asset address is thoroughly vetted and confirmed to be the intended token before deployment. Consider adding a mechanism to allow the Beacon owner to pause the vault or change the asset if a misconfiguration is detected, although this would add complexity.

Status

Unresolved

Info

Redundant __ERC20_init Call

The initialize function includes a call to __ERC20_init("", ""), which sets the ERC-20 name and symbol of the shares token to empty strings. However, the contract immediately overrides the name() and symbol() functions to derive these values from the underlying asset. Consequently, the __ERC20_init call is redundant as its effects are immediately superseded by the overrides.I-01

Issue

The initialize function includes a call to __ERC20_init("", ""), which sets the ERC-20 name and symbol of the shares token to empty strings. However, the contract immediately overrides the name() and symbol() functions to derive these values from the underlying asset. Consequently, the __ERC20_init call is redundant as its effects are immediately superseded by the overrides.

Fix

The __ERC20_init("", "") call can be safely removed from the initialize function without affecting the contract's functionality or security, potentially saving a small amount of gas during initialization.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The StoxWrappedTokenVault contract serves as an upgradeable ERC-4626 vault implementation for a BeaconProxy. The contract leverages well-audited OpenZeppelin libraries, ensuring a solid foundation for its core vault functionalities. Key strengths include proper upgradeability patterns and basic input validation. Identified issues primarily relate to potential incompatibilities with certain ERC-20 token types and critical initialization parameter handling, leading to a Medium overall risk level.

Technical7/10Low risk

The contract exhibits good technical security, primarily due to its reliance on OpenZeppelin's battle-tested ERC4626Upgradeable library (7.2 Code Security). The custom logic is minimal, focusing on initialization and token metadata overrides, which are implemented correctly. Input validation for the asset address (e.g., ZeroAsset() check) is present, enhancing robustness (7.2 Code Security). External calls to the underlying asset's name() and symbol() functions are for view-only data, posing minimal reentrancy risk (7.6 External).

Governance2/10High risk

The primary economic risk (7.4 Economic) stems from the vault's potential incompatibility with non-standard ERC-20 tokens, such as fee-on-transfer or rebasing tokens, which could lead to accounting discrepancies and user losses. The contract itself lacks internal governance mechanisms (7.5 Governance), relying entirely on the BeaconProxy's owner for any operational changes or upgrades. This centralizes control, which is typical for such a vault but means the security of the system is highly dependent on the Beacon owner's security practices (7.3 Access Control).

Upgrades1/10High risk

The contract is designed as an upgradeable implementation for a BeaconProxy, correctly utilizing OpenZeppelin's Initializable pattern (7.7 Upgrades). The _disableInitializers() in the constructor prevents direct initialization of the implementation, and the initialize function uses the initializer modifier, ensuring it can only be called once by the proxy. This architecture allows for secure and controlled upgrades of the vault's logic via the Beacon (7.1 Architecture).

Final RecommendationWhat to do about this score

Ensure thorough due diligence on the underlying asset token to confirm its compatibility with the ERC-4626 standard, particularly regarding fee-on-transfer or rebasing mechanisms.

Implement robust operational procedures for the BeaconProxy's owner, including multi-signature control and time-locks for upgrades, to mitigate centralized control risks. Verify the correctness of the initialization data, especially the asset address, during deployment to prevent critical misconfigurations.

Contract & Record

1 audit on record
TypeBeaconProxy
NetworkBase
Token age1y
Contract0x5cda…2204
Deployer0x691a…4451
Proxy Upgrade Controls
Proxy TypeBeacon
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Wrapped Coinbase Global Inc ST0x security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202659Medium
  2. Sep 2, 202658Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the WTCOIN contract address?

The Wrapped Coinbase Global Inc ST0x (WTCOIN) contract on Base is 0x5cda0e1ca4ce2af96315f7f8963c85399c172204. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Wrapped Coinbase Global Inc ST0x a scam?

Quantum Audit's risk score for Wrapped Coinbase Global Inc ST0x is 59/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Upgradeable; Honeypot: None found; Buy / sell tax: 0% / 0%. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is WTCOIN liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $154.1K.

Who holds WTCOIN?

As of Sep 4, 2026, the 10 largest holders own 86.7% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
OpenServSERV · Base59MediumMorpho TokenMORPHO · Base60MediumTether USDUSDT · Base60MediumOMI TokenOMI · Base58MediumevoBase60MediumSilencioSLC · Base58Medium

Would You Like a More Detailed Audit of Wrapped Coinbase Global Inc ST0x?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page