Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Wrapped liquid staked Ether 2.0 Safe?

WSTETHEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Low RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical10/10Governance4/10Upgrades6/10Checks passed3 of 5Findings1 Low · 3 Info4
SummaryAI Copilot

The audited contract is a standard ERC20 token implementation, likely based on OpenZeppelin's well-vetted libraries.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Top-10 concentration > 20%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 56.4%
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Top-10 concentration > 20% (65.4% total → 26.8% effective; 1.1% in EOAs, 64.4% in contracts — mild)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 56.4% (independent LP — depth risk, pool = 34% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipUnknown
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
64.4%Contracts1.1%34.6%Everyone else
64.4%Contracts34.6%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
65.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking64.4%
  • Walletsanonymous holders, free to sell1.1%
  • Everyone elsethe rest of the supply34.6%
Effective concentrationwhat the score reads26.8%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$18.63M across 19 pairs
Show 4 more pairs

The 9 remaining pairs hold $64.3K between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$6.42MShare of depth34.5%
Top-1 Unlocked Holder56.4%
Top-3 Unlocked78.6%
Unlocked LP held by
0x9c7f…053a0xe8dc…daa60x91b2…d6eb0x25dc…4cee0xaf40…aec60x9510…54c60xc704…d55a0xb80c…23ac0x16a7…67cc0xc441…f196

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low3 Info
Low

Potential for Misuse of _beforeTokenTransfer Hook

The _beforeTokenTransfer hook is an internal virtual function that is called before any token transfer, mint, or burn operation. While it is empty in the base ERC20 contract, a derived contract could override this function to introduce complex logic, reentrancy vectors, or other vulnerabilities if not implemented carefully. Improperly implemented custom logic in this hook could lead to unexpected behavior or security exploits.L-01

Issue

The _beforeTokenTransfer hook is an internal virtual function that is called before any token transfer, mint, or burn operation. While it is empty in the base ERC20 contract, a derived contract could override this function to introduce complex logic, reentrancy vectors, or other vulnerabilities if not implemented carefully. Improperly implemented custom logic in this hook could lead to unexpected behavior or security exploits.

Fix

Any contract inheriting from ERC20 and overriding _beforeTokenTransfer must ensure that the custom logic is thoroughly audited for reentrancy, gas limits, and other potential side effects. Avoid external calls within this hook or ensure they are protected against reentrancy if necessary.

Status

Unresolved

Info

Token Non-Functional As-Is

The ERC20 contract, as provided, initializes _totalSupply to 0 and does not expose any public or external functions for minting new tokens. This means that upon deployment, the token will have a total supply of zero, rendering it non-functional for transfers unless a derived contract implements minting logic (e.g., in its constructor or via an external function). This is a design choice for a base contract but makes it unusable as a standalone token.I-01

Issue

The ERC20 contract, as provided, initializes _totalSupply to 0 and does not expose any public or external functions for minting new tokens. This means that upon deployment, the token will have a total supply of zero, rendering it non-functional for transfers unless a derived contract implements minting logic (e.g., in its constructor or via an external function). This is a design choice for a base contract but makes it unusable as a standalone token.

Fix

Ensure that the inheriting contract (e.g., WstETH) properly implements initial token supply minting or provides controlled minting mechanisms to make the token functional. This typically involves calling the internal _mint function in the constructor of the derived token contract or through an externally callable function with appropriate access control.

Status

Unresolved

Info

ECDSA Library Present but permit Not Implemented

The ECDSA library and IERC20Permit interface are included in the codebase, suggesting an intention to implement the ERC-2612 permit functionality. However, the ERC20 contract itself does not implement the permit function, which allows users to approve token transfers via a signed message rather than an on-chain transaction.I-02

Issue

The ECDSA library and IERC20Permit interface are included in the codebase, suggesting an intention to implement the ERC-2612 permit functionality. However, the ERC20 contract itself does not implement the permit function, which allows users to approve token transfers via a signed message rather than an on-chain transaction.

Fix

If permit functionality is desired for the WstETH token, ensure it is correctly implemented in the derived contract, leveraging the ECDSA library for signature verification and adhering to the ERC-2612 standard. Pay close attention to nonce management and signature validation to prevent replay attacks.

Status

Unresolved

Info

Use of Older Solidity Version

The contract uses Solidity version 0.6.12. While this version is generally stable and widely used, newer versions (e.g., 0.8.x) include built-in overflow/underflow checks, removing the explicit need for SafeMath and potentially simplifying the code. Newer compilers also offer various optimizations and bug fixes.I-03

Issue

The contract uses Solidity version 0.6.12. While this version is generally stable and widely used, newer versions (e.g., 0.8.x) include built-in overflow/underflow checks, removing the explicit need for SafeMath and potentially simplifying the code. Newer compilers also offer various optimizations and bug fixes.

Fix

Consider upgrading to Solidity 0.8.x or later for new deployments to benefit from native overflow checks and other compiler improvements. If upgrading, ensure all code is compatible with the new compiler version and thoroughly re-audited, as syntax and behavior changes may exist.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The audited contract is a standard ERC20 token implementation, likely based on OpenZeppelin's well-vetted libraries. It utilizes SafeMath for arithmetic safety and adheres to common security practices. The primary findings are informational, related to the base contract's non-functional state without further implementation (e.g., initial supply minting) and the presence of the ECDSA library without a corresponding permit function. One low-severity finding notes the potential for misuse of the _beforeTokenTransfer hook if overridden by a derived contract. Overall, the technical risk is low, reflecting a robust and secure foundation.

Technical10/10Low risk

The technical architecture is based on a well-established OpenZeppelin ERC20 standard, leveraging SafeMath for robust arithmetic operations (7.1 Architecture, 7.2 Code Security). The contract demonstrates strong adherence to common security practices for token implementations. A minor concern is the _beforeTokenTransfer hook, which, if overridden in a derived contract, could introduce new vulnerabilities (7.2 Code Security).

Governance4/10Medium risk

The contract implements standard ERC20 token economics, focusing on transfers and allowances without complex economic models or governance mechanisms (7.4 Economic, 7.5 Governance). The base contract does not define an initial token supply or minting functions, which means it is not functional as a standalone token (7.4 Economic). There are no specific governance roles or voting mechanisms (7.5 Governance).

Upgrades6/10Medium risk

The contract is not designed with an upgradeability pattern (e.g., proxy) (7.7 Upgrades). This simplifies the deployment model by eliminating upgrade-related risks such as storage collisions or logic inconsistencies. However, it means that any future changes to the token's core logic would require a new deployment and migration, which is a standard approach for non-upgradeable tokens.

Final RecommendationWhat to do about this score

The provided ERC20 contract serves as a robust and well-audited base for a token implementation.

For the WstETH token, it is crucial to ensure that the inheriting contract properly initializes the token's total supply and implements any necessary minting or burning mechanisms with appropriate access controls. Additionally, if the permit functionality is intended, its implementation should be carefully reviewed. Consider using a more recent Solidity compiler version for future deployments to leverage native safety features.

Contract & Record

1 audit on record
TypeToken
NetworkEthereum
Token age3y
Contract0x7f39…2ca0
Deployer0xe19f…f57b
Badge for your website
Wrapped liquid staked Ether 2.0 security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202612Low
  2. Aug 11, 202634Low

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the WSTETH contract address?

The Wrapped liquid staked Ether 2.0 (WSTETH) contract on Ethereum is 0x7f39c581f595b53c5cb19bd0b3f8da6c935e2ca0. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Wrapped liquid staked Ether 2.0 a scam?

Quantum Audit's risk score for Wrapped liquid staked Ether 2.0 is 12/100 (Low risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is WSTETH liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $18.63M.

Who holds WSTETH?

As of Sep 4, 2026, the 10 largest holders own 65.4% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
A Hunters DreamCAW · Ethereum12LowTetherUSDT · Ethereum12LowLCXEthereum12LowapxUSDEthereum12LowManyuEthereum13LowHEXEthereum11Low

Would You Like a More Detailed Audit of Wrapped liquid staked Ether 2.0?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page