Contract report

Risks (9)

• HighUnknown (unverified bytecode) can pause the contractpauseDeterministic

  setPaused(bool) (unknown (unverified bytecode)): can pause the contract's functions (e.g. deposits, payments or withdrawals).

  Evidence

  • staticprivilege setPaused(bool) restricted to unknown (unverified bytecode)
    Show source

    Can pause / freeze all transfers [selector 0x16c38b3c]

  Confirmed by: facts

• MediumSource code is not verifiedotherDeterministic

  The contract source is not published on the explorer, so nobody can read what it really does. The analysis relies on bytecode only.

  Evidence

  • on-chainexplorer: no verified source for 0x202A08e43bb7C93a2f88dd225c80E8622b626aBd
  • on-chaincontract.verified = false; sourceFileCount = 0

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumContract is upgradeableproxy-upgradeDeterministic

  The contract logic can be replaced by its proxy admin (admin type unknown).

  Evidence

  • on-chainuups proxy; implementation 0xcA86777F013215e7d08b39F7c4108bc2403a6074; admin unknown
  • on-chaincontract.isProxy = true, proxyType = uups, implementation = 0xcA86777F013215e7d08b39F7c4108bc2403a6074
    Show source

    Upgradeable uups proxy: logic can be replaced at any time (implementation 0xcA86777F013215e7d08b39F7c4108bc2403a6074)

  • on-chaincontract.proxyAdminKind = unknown; contract.verified = false
  • webhttp://zkblast.tech/docs
    Show source

    Use the proxy address for integrations and transactions. It remains stable across upgrades.

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumAdmin role can grant anyone upgrade and factory powersownershipAI

  setRole(bytes32,address,bool), hasRole, DEFAULT_ADMIN_ROLE, UPGRADER_ROLE and FACTORY_ROLE show an access-control system. An administrator() getter also exists. Whoever holds the admin role can give any address the upgrade or factory powers, or take them away. Ownership is not renounced. The holders of these roles are not shown in the material.

  Evidence

  • on-chaincontract.ownerRenounced = false

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

• MediumSwap on the project website failed in our testclaims-mismatchAI

  The site presents working public DLMM/DAMM swaps. In a scripted run of zkblast.tech/trade on a local fork, the test wallet had funds but completed no transaction. Swapping USDG for ZKBLAST failed with 'Swap could not be completed'. This may be a UI or fork issue rather than fraud, but the advertised core feature could not be shown to work. The only wallet action requested was an off-chain SIWE sign-in message. No token approval or Permit signature was requested.

  Evidence

  • forkdappTests: Swap — observed
    Show source

    wallet no balance change; 0 tx (none). No successful transaction was made for this goal (fail).

  • forkdappTests: Swap — tx 1 personal_sign (SIWE login)
    Show source

    Sign in to ZKBLAST.

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowProtocol fee recipient and fee cap cannot be identifiedfeesAI

  The pool keeps protocol fees (protocolFees0, protocolFees1), has a feePips setting and a collectProtocolFees() function that pays out to protocolFeeRecipient(). The material does not show the recipient, who can change it, or whether feePips has an upper limit. If the fee can be raised without a cap, traders and liquidity providers could be over-charged.

  Evidence

  • on-chaincontract.params = [] (no live admin parameters available)

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

• LowPosts claim live private swaps but the site shows zero marketsclaims-mismatchAI

  The official account says private USDG swaps were demonstrated, anti-sniper protection is live, and launchpads are live on HyperEVM. The public site still shows zero indexed pools, zero validated markets, and zero active markets, and its own disclosure list includes "Not offered yet." Docs also say the contract directory is loaded from an API and was still "Loading deployment manifests…" with no addresses on the page. The reviewed contract itself is unverified, so those shipping claims cannot be checked from this material.

  Evidence

  • Xhttps://x.com/zkblast9/status/2117735570977829087
    Show source

    Private USDG Swaps Demonstrated shielded transactions, private notes, and onchain settlement.

  • Xhttps://x.com/zkblast9/status/2117861079678324888
    Show source

    INSPIRED ANTI-SNIPER PROTECTION IS NOW LIVE ON ZKBLAST.

  • webhttp://zkblast.tech/
    Show source

    0 indexed Validated pool registry

  • webhttp://zkblast.tech/
    Show source

    0 validated markets

  • webhttp://zkblast.tech/
    Show source

    Not offered yet

  • webhttp://zkblast.tech/docs
    Show source

    Loading deployment manifests…

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

• LowUnproven posts say team is a rebrand of rugged Quanta projectdeployer-historyAI

  Several accounts claim @zkblast9 is the same team as @QuantaPools, which they say already rugged, and they point at Robinhood address 0x1da8…9b63 plus the bio token address. The posts do not include a transaction, shared deployer, or other proof in the text returned here, and another reply says Quanta and ZKBLAST are already two separate projects. Treat the rug-team link as an allegation, not a confirmed deployer history.

  Evidence

  • Xhttps://x.com/alphadegen69/status/2118097203952550124
    Show source

    @QuantaPools already rugged and launched same rebranded UI project as @zkblast9

  • Xhttps://x.com/alphadegen69/status/2118201210281058804
    Show source

    $Zkblast is same quanta team that rugged and rebranded to Zkblast

  • Xhttps://x.com/dr_osse/status/2117947783399268574
    Show source

    Looks like they are affiliated with the $quantapools that rugged, not long ago

  • Xhttps://x.com/sonofsun1984/status/2118154063011328286
    Show source

    Already 2 separate projects as you can see in quoted post

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

• LowThird parties post airdrop-vote bait about the tokensocialAI

  Accounts that are not the project are telling people that voting or backing $ZKBLAST pays an allocation "already," using the bio contract address. That is a common airdrop lure. It is not a post from @zkblast9, but anyone following those links can be phished or buy the wrong thing.

  Evidence

  • Xhttps://x.com/Keshavjoshi070/status/2118200115982668246
    Show source

    voted $ZKBLAST and the wallet's already heavier for it. allocation's yours the second you cast it

  • Xhttps://x.com/m_hfcx/status/2118096606549447042
    Show source

    watching everyone rack up airdrops for backing $ZKBLAST while you hesitate is wild. votes equal free coin

  Confirmed by: grok-4.7, gpt-5.6-sol

Notes (4)

• LowProject is weeks old: domain registered a day after deploywebsiteAI

  The contract was deployed on 2026-10-19 and the zkblast.tech domain was registered on 2026-10-20. The first archived copy of the site is from the same day. The project has a short track record and no history to judge it by.

  Evidence

  • on-chaincontract.deployedAt = 2026-10-19T14:39:00.000Z; deployer = 0xB5C0eD0252d1906Fca50664Eb2198Aea0679920B
  • webhttp://zkblast.tech/

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• InfoX bio lists a token address, not this pool contractclaims-mismatchAI

  The @zkblast9 bio tells people the project CA is 0x3f9f…ecd7. The contract this review was given is a different address, 0x202a…6abd, deployed by 0xB5C0…920B. Anyone copying the bio address is not looking at this contract. This review cannot confirm what the bio address does.

  Evidence

  • on-chaintarget = 0x202a08e43bb7c93a2f88dd225c80e8622b626abd
    Show source

    deployer 0xB5C0eD0252d1906Fca50664Eb2198Aea0679920B, verified false, ownerRenounced false

  Confirmed by: grok-4.7 · Disputed by: claude-opus-5.5, gpt-5.6-sol

• InfoNew X account with no named teamsocialAI

  The X account was created on 2026-10-28, the domain on 2026-10-20, and the reviewed contract on 2026-10-19. Followers are about 446 with likes mostly in the tens, which is small but not a huge dead following. The account says a FOMO team tag was applied for, not that a verified FOMO dev badge is live, and no legal name is given. Identity is unverifiable from this material. A scanner bot (LarpCheck) also scored the privacy story as only partly real; that is an allegation, and the project's own docs are more cautious than the marketing posts.

  Evidence

  • webhttp://zkblast.tech/
  • Xhttps://x.com/zkblast9/status/2117523321155907955
    Show source

    Team tag application submitted. Official fomo profile: https://t.co/MqQMyT0la9

  • Xhttps://x.com/Larpcheckbot/status/2118170406565613957
    Show source

    Privacy claim stronger than the docs Couldn't confirm yet: - Shielded vault use not confirmed

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

• InfoBlockscout does not flag the contract as a scamotherAI

  Blockscout labels show is_scam=false and reputation=ok. This is only a weak extra signal and does not offset the unverified, upgradeable design.

  Evidence

  • on-chainexplorer: source=blockscout, isScam=false, reputation=ok

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol