Quantum Audit Logo
Launch App

Early-stage security check — honeypot & rug-pull analysis

Is Wrapped State Street SPDR Portfolio S&P 500 ETF ST0x a Scam?

WTSPYMBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 6, 2026 · 1 audit on recordNew Launch · 1d old
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical7/10Governance1/10Upgrades1/10Checks passed3 of 7Findings1 Low · 2 Info3
SummaryAI Copilot

The StoxWrappedTokenVault contract, serving as an ERC-4626 implementation behind a BeaconProxy, has been audited.

Read the full analysis
What raised the score
  • Ownership status UNKNOWN
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract
  • Complex proxy pattern
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • Token age < 7 days
  • 1 Low finding(s) from audit
Exact factors
  • Ownership status UNKNOWN (owner could not be resolved)
  • Mintable supply — no cap found, dilution unbounded
  • Proxy contract (upgradeable — admin can replace logic)
  • Complex proxy pattern (BEACON)
  • Top-10 concentration > 30% (98.2% total → 41.1% effective; 3.0% in EOAs, 95.2% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 92% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 92% of DEX liquidity)
  • Token age < 7 days (early, volatile)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Early-stage analysis. This token has limited on-chain history (1d old). New tokens carry elevated risk — data may change rapidly. Always verify independently before investing.

Security Checklist

as of audit · Sep 63 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 6, 2026
95.2%Contracts3.0%1.8%
95.2%Contracts
ContractsWalletsEveryone elseBubble area = share of supply
98.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking95.2%
  • Walletsanonymous holders, free to sell3.0%
  • Everyone elsethe rest of the supply1.8%
Effective concentrationwhat the score reads41.1%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 6, 2026

Liquidity

as of audit · Sep 6$811.2K across 10 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$744.7KShare of depth91.8%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x1791…e359

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Low2 Info
Low

Potential for Non-Standard ERC-20 Asset Issues

The StoxWrappedTokenVault is an ERC-4626 vault that wraps an underlying ERC-20 asset. While OpenZeppelin's ERC-4626 implementation is robust, certain non-standard ERC-20 tokens (e.g., rebase tokens, tokens with transfer fees, tokens that revert on zero-value transfers, tokens with non-boolean return values for transfer/transferFrom) can cause unexpected behavior, accounting discrepancies, or loss of funds within an ERC-4626 vault. The current contract does not implement specific safeguards or checks for such tokens, relying solely on the standard ERC-20 interface.L-01

Issue

The StoxWrappedTokenVault is an ERC-4626 vault that wraps an underlying ERC-20 asset. While OpenZeppelin's ERC-4626 implementation is robust, certain non-standard ERC-20 tokens (e.g., rebase tokens, tokens with transfer fees, tokens that revert on zero-value transfers, tokens with non-boolean return values for transfer/transferFrom) can cause unexpected behavior, accounting discrepancies, or loss of funds within an ERC-4626 vault. The current contract does not implement specific safeguards or checks for such tokens, relying solely on the standard ERC-20 interface.

Fix

Before deploying with a specific asset, thoroughly review the underlying ERC-20 token's contract for any non-standard behaviors. If such behaviors are identified, consider implementing custom logic within the vault (e.g., by overriding _deposit, _withdraw, _mint, _redeem functions) to handle them gracefully, or restrict the vault to only support standard ERC-20 tokens. Comprehensive testing with the chosen asset is crucial.

Status

Unresolved

Info

Unused/Decoy initialize(address) Function

The contract includes an initialize(address asset) external pure returns (bytes32) function that immediately reverts with InitializeSignatureFn(). This function is marked pure, meaning it cannot modify state, and its immediate revert makes it harmless. However, its presence alongside the actual initialize(bytes calldata data) function could be confusing or misleading for developers or auditors.I-01

Issue

The contract includes an initialize(address asset) external pure returns (bytes32) function that immediately reverts with InitializeSignatureFn(). This function is marked pure, meaning it cannot modify state, and its immediate revert makes it harmless. However, its presence alongside the actual initialize(bytes calldata data) function could be confusing or misleading for developers or auditors.

Fix

Consider removing the unused initialize(address asset) function to improve code clarity and reduce potential confusion. If it serves a specific, non-obvious purpose (e.g., preventing a specific signature collision), add a comment explaining its intent.

Status

Unresolved

Info

Reliance on External ICloneableV2 Interface

The contract implements the ICloneableV2 interface and returns ICLONEABLE_V2_SUCCESS from its initialize function. This indicates that the contract is designed to be deployed via a factory that expects this specific interface and return value. While not a vulnerability in the vault itself, this is an important architectural dependency that should be understood for proper deployment, management, and interaction with the vault instances.I-02

Issue

The contract implements the ICloneableV2 interface and returns ICLONEABLE_V2_SUCCESS from its initialize function. This indicates that the contract is designed to be deployed via a factory that expects this specific interface and return value. While not a vulnerability in the vault itself, this is an important architectural dependency that should be understood for proper deployment, management, and interaction with the vault instances.

Fix

Ensure that the factory deploying instances of this vault is correctly configured to interact with the ICloneableV2 interface and handles the expected return value. Document this architectural dependency clearly for future development and operational teams.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 6
Executive SummaryWhat the contract is and what the review found

The StoxWrappedTokenVault contract, serving as an ERC-4626 implementation behind a BeaconProxy, has been audited. The contract is minimal, primarily relying on well-vetted OpenZeppelin upgradeable libraries. No critical or high-severity vulnerabilities were identified. Minor issues include potential compatibility challenges with non-standard ERC-20 assets and an unused initialization function. The upgradeability mechanism is correctly implemented.

Technical7/10Low risk

The contract (7.1 Architecture) is a straightforward ERC-4626 vault implementation, inheriting extensively from OpenZeppelin's battle-tested upgradeable contracts. This significantly reduces the attack surface and enhances (7.2 Code Security) robustness against common vulnerabilities like reentrancy and integer overflows. The initialization logic (7.3 Access Control) correctly uses the initializer modifier and _disableInitializers() in the constructor, preventing re-initialization on the implementation contract itself. A minor concern is the potential for unexpected behavior with non-standard ERC-20 assets (7.6 External), which is a common caveat for ERC-4626 vaults.

Governance1/10High risk

The contract implements a standard ERC-4626 vault (7.4 Economic) without introducing complex economic models, fees, or governance mechanisms (7.5 Governance). Its economic behavior is primarily dictated by the underlying asset and the ERC-4626 standard's share-to-asset conversion logic. The primary economic risk stems from the chosen underlying asset's properties, rather than the vault's internal mechanics.

Upgrades1/10High risk

The contract is designed as an upgradeable implementation for a BeaconProxy (7.7 Upgrades), correctly utilizing OpenZeppelin's Upgradeable pattern. The _disableInitializers() function in the constructor prevents direct initialization of the implementation contract, safeguarding against storage collisions. The initialize function, protected by the initializer modifier, ensures secure, one-time initialization for each proxy instance.

Final RecommendationWhat to do about this score

It is recommended to thoroughly test the vault with the specific underlying ERC-20 asset intended for deployment, paying close attention to any non-standard behaviors of the asset.

Implement robust monitoring for the vault's operations and the underlying asset's health. Consider adding explicit checks or warnings if non-standard ERC-20 tokens are to be supported in the future.

Contract & Record

1 audit on record
TypeBeaconProxy
NetworkBase
Token age1d
Contract0x31c2…c2d8
Deployer0xc4e7…6888
Proxy Upgrade Controls
Proxy TypeBeacon
ImplementationVerified source
Upgrades (30d)0 · stable
Badge for your website
Wrapped State Street SPDR Portfolio S&P 500 ETF ST0x security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 6, 202664Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
BaseStonkBSTONK · Base64MediumVelvetBase63MediumDiemBase63Mediumether.fi governance tokenETHFI · Base65HighjesseBase63MediumRipe DAO Governance TokenRIPE · Base63Medium

Would You Like a More Detailed Audit of Wrapped State Street SPDR Portfolio S&P 500 ETF ST0x?

This token is brand new. Run a deeper AI-powered analysis of the contract code — free and instant.

Get Detailed Audit Is this your token? Publish your own audit on this page