Quantum Audit Logo
Launch App

Is Wrapped Frax Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Wrapped Frax WFRAX
0x04ac…977f
Ethereum
Not verifiedThis record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked today 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The WFRAXTokenOFTUpgradeable contract functions as a cross-chain ERC-20 token, leveraging the LayerZero OFT standard. The audit identified a medium-severity issue where an external 'endpoint' address possesses the capability to mint new tokens, potentially leading to token dilution. The contract is upgradeable via a TransparentUpgradeableProxy, with administrative control managed by a Timelock and the implementation owner by a multisig.

2 Medium4 Informational
Volume 24h
$336.0K
Liquidity
$2.10M
Price
$0.3304
Token Age
1y
Top 10 Holders
95.7%

Security Findings

2 Med4 Info
Medium

External Endpoint Can Mint New Tokens

CP-01The WFRAXTokenOFTUpgradeable contract allows an external address, referred to as the 'endpoint', to create new tokens. Specifically, the `send`, `lzReceiveSimulate`, and `lzReceive` functions, which are restricted to this 'endpoint', can increase the total supply of WFRAX tokens. This means that if the 'endpoint' address is compromised or misused, new tokens could be minted, diluting the value for all existing token holders.
IssueThe WFRAXTokenOFTUpgradeable contract allows an external address, referred to as the 'endpoint', to create new tokens. Specifically, the `send`, `lzReceiveSimulate`, and `lzReceive` functions, which are restricted to this 'endpoint', can increase the total supply of WFRAX tokens. This means that if the 'endpoint' address is compromised or misused, new tokens could be minted, diluting the value for all existing token holders.
FixToken holders should be aware that the 'endpoint' address has the power to mint new WFRAX tokens. It is crucial for the project team to ensure the security of this 'endpoint' address through strong operational security practices, such as multi-signature control or a timelock, to prevent unauthorized minting and protect the token's value.
StatusUnresolved
Medium

Liquidity not locked

QA-LIQUIDITY0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x4b5c…df67 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 81% of the token's DEX liquidity; the other pools were not assessed.
Issue0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x4b5c…df67 — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them. This assessment covers the main pool, which holds 81% of the token's DEX liquidity; the other pools were not assessed.
FixCheck the lock's end date and beneficiary on the locker's own page before relying on it.
StatusAcknowledged
Info

Who holds the supply

QA-HOLDERSThe ten largest holders own 95.7% of supply. What remains: 27.3% in wallets, 68.4% in other contracts. 942 holders in total.
IssueThe ten largest holders own 95.7% of supply. What remains: 27.3% in wallets, 68.4% in other contracts. 942 holders in total.
FixWatch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
StatusAcknowledged
Info

Listed, but not independently verified

QA-IDENTITYListed on CoinGecko as Wrapped FRAX (WFRAX), market cap $18M. 942 holders.
IssueListed on CoinGecko as Wrapped FRAX (WFRAX), market cap $18M. 942 holders.
FixMatch the contract address against the project's official channels before trading.
StatusAcknowledged
Info

The market for this token

QA-MARKETLiquidity $2.6M (DexScreener, all pools). 24h trading volume $1.3M (CoinGecko, all markets, daily snapshot). 24h trading volume $404K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $4.40 on 2025-05-19; the price is now 92.5186% below it.
IssueLiquidity $2.6M (DexScreener, all pools). 24h trading volume $1.3M (CoinGecko, all markets, daily snapshot). 24h trading volume $404K (DexScreener, all pools). CoinGecko's record for this coin: all-time high $4.40 on 2025-05-19; the price is now 92.5186% below it.
FixSize any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
StatusAcknowledged
Info

Asset class: Wrapped or bridged asset

QA-PROFILEA token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Wrapped-Tokens. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-5 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $2.6M of DEX liquidity across 3 pools. Launch: 495 days of market history.
IssueA token representing another asset's units 1:1, backed by a wrapping contract, a custodian or a bridge. The class itself adds no points; the contract and market facts decide the score. Basis: CoinGecko category: Wrapped-Tokens. Tokenomics — Supply: mintable with no on-chain cap found. Control: a 3-of-5 multisig. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $2.6M of DEX liquidity across 3 pools. Launch: 495 days of market history.
FixThe backing is the risk: check who holds the underlying asset and how redemption works.
StatusAcknowledged

Category Ratings

TechnicalMedium6/10

The WFRAXTokenOFTUpgradeable contract implements the ERC-20 standard and LayerZero's OFT functionality, enabling cross-chain transfers (7.1 Architecture). The code leverages established upgradeable patterns and modules for features like EIP-3009 and EIP-712 signatures. A key concern (7.2 Code Security) is the ability for an external 'endpoint' address to mint new tokens via `send`, `lzReceiveSimulate`, and `lzReceive`, which could lead to token dilution. Access control (7.3 Access Control) for administrative functions like `setMsgInspector` and `setPeer` is appropriately restricted to the contract owner.

GovernanceHigh1/10

The contract's economic model (7.4 Economic) is directly impacted by the minting capability. While the primary owner (a 3/5 multisig) controls administrative settings, the ability to mint tokens rests with an 'endpoint' address, which is an external dependency. This introduces a significant economic risk as unauthorized or compromised control of this endpoint could dilute token holders. Governance (7.5 Governance) over the contract's core parameters is centralized with the multisig owner, which provides a degree of security through multi-party control, but the minting function's dependency on an external entity remains a concern.

UpgradesHigh1/10

The contract is deployed behind a TransparentUpgradeableProxy (7.7 Upgrades), allowing for future logic upgrades. The proxy's admin is controlled by a Timelock () with a 1-day delay, which provides a window for users to react to impending changes. The implementation contract's owner is a 3/5 multisig (), enhancing security for critical administrative functions. While the upgrade mechanism itself is standard and includes a timelock, the inherent power of upgrades means that significant changes to the contract's logic, including its economic model or access controls, can be introduced, warranting a Medium risk level.

Security Checklist

1/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyFail
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Proxy Upgrade Controls

Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin → Timelock
ImplementationVerified source
Upgrades (30d)0 · stable

Holder Composition

95.7% in top 10
27.3% in wallets68.4% in contracts
Effective Concentration54.7%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$2.59M across 3 pairs
FraxswapfrxUSDanalysed$2.10M81.2%Uniswap v4FXS$339.6K13.1%Curve stblFXS$147.5K5.7%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

2 addresses
Deployer
0x0990…814b
Unlocked LP Held By
0x4b5c…df67

What Raised This Score

4 factors
  • Mintable supply — no cap found, dilution unbounded; held by endpoint: Other-Contract
  • Upgradeable proxy — the admin can replace the logic; admin: ProxyAdmin -> Timelock
  • Liquidity NOT locked (100% of the pool; this pool is 81% of DEX liquidity) — who holds it cannot be verified
  • Top-10 concentration > 50% (95.7% total → 54.7% effective; 27.3% in EOAs, 68.4% in contracts)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Wrapped Pulse from PulseChain (WPLS)High RiskFLOKIHigh RiskAmpHigh RiskStargate Finance (STG)High RiskEspresso (ESP)Medium RiskPRDCTR (PRD)Medium Risk

Would You Like a More Detailed Audit of Wrapped Frax?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit