Contract report

Risks (9)

• HighUnknown (unverified bytecode) can pause the contractpauseDeterministic

  setPaused(bool) (unknown (unverified bytecode)): can pause the contract's functions (e.g. deposits, payments or withdrawals).

  Evidence

  • staticprivilege setPaused(bool) restricted to unknown (unverified bytecode)
    Show source

    Can pause / freeze all transfers [selector 0x16c38b3c]

  • on-chainprivileges: setPaused(bool) selector 0x16c38b3c
    Show source

    Can pause / freeze all transfers [selector 0x16c38b3c]

  • on-chainfunctions: paused() selector 0x5c975abb

  Confirmed by: facts, claude-opus-5.5, grok-4.7

• HighWithdrawal and proof checks cannot be reviewed in unverified codeotherAI

  No verified source or decompiled code exists, and slither did not run. The function list points to a commitment / Merkle-tree privacy vault: deposit(address,uint256,bytes32), root(), nextLeafIndex(), commitmentInserted(bytes32) and stateRegistry(). The withdraw or proof-verification path is not identifiable; it may be among the many unnamed selectors. Users cannot check that withdrawals work, that proofs are properly verified, or that no hidden sweep function exists.

  Evidence

  • on-chainfunctions: deposit(address,uint256,bytes32) 0x26b3293f; root() 0xebf0c717; nextLeafIndex() 0x0be4f422; commitmentInserted(bytes32) 0xdc5b52b3; unknown_0xe193c384, unknown_0xfaab7f78, unknown_0xabe3dfc4, unknown_0xbbec6aae, unknown_0xc2dad2a8, unknown_0xc573c20b, unknown_0x70d71784, unknown_0x8da05743, unknown_0x5b41faff, unknown_0x5cc52336, unknown_0x1d349f8b

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumSource code is not verifiedotherDeterministic

  The contract source is not published on the explorer, so nobody can read what it really does. The analysis relies on bytecode only.

  Evidence

  • on-chainexplorer: no verified source for 0xAAC59EBDE79E4e0eA0824BBE2562036b0fd5748A

  Confirmed by: facts

• MediumContract is upgradeableproxy-upgradeDeterministic

  The contract logic can be replaced by its proxy admin (admin type unknown).

  Evidence

  • on-chainuups proxy; implementation 0x229375Fb963b3EBEb8aa46aAfD5eAb31D497bA61; admin unknown
  • on-chainisProxy = true, proxyType = uups, implementation 0x229375Fb963b3EBEb8aa46aAfD5eAb31D497bA61
    Show source

    Upgradeable uups proxy: logic can be replaced at any time (implementation 0x229375Fb963b3EBEb8aa46aAfD5eAb31D497bA61)

  • on-chainfunctions: upgradeToAndCall(address,bytes) selector 0x4f1ef286; UPGRADER_ROLE() selector 0xf72c0d8b
    Show source

    access: unknown (unverified)

  • on-chainproxyAdminKind = unknown; verified = false

  Confirmed by: facts, claude-opus-5.5, grok-4.7, gpt-5.6-sol

• MediumAdmin role can grant upgrade and factory powers to any addressownershipAI

  The contract uses roles: DEFAULT_ADMIN_ROLE, UPGRADER_ROLE and FACTORY_ROLE, managed through setRole(bytes32,address,bool) and checked with hasRole. Whoever controls the admin role can give any address the upgrade power, and through it full control of the vault. It can also grant FACTORY_ROLE, whose powers are unknown and may include adding assets or settings through assetConfig. None of the role holders are identified in the facts.

  Evidence

  • on-chainprivileges: setRole(bytes32,address,bool) selector 0x6a951316
    Show source

    Can grant/revoke privileged roles [selector 0x6a951316]

  • on-chainfunctions: DEFAULT_ADMIN_ROLE() 0xa217fddf; FACTORY_ROLE() 0x04a0fb17; hasRole(bytes32,address) 0x91d14854

  Confirmed by: claude-opus-5.5, grok-4.7 · Disputed by: gpt-5.6-sol

• MediumSite says only you control deposits, but admin can upgrade or pauseclaims-mismatchAI

  The website presents the shielded vault as one where a deposit becomes a private note only the depositor can prove they own. It also says a lost note cannot be recovered by anyone. That implies no third party controls the funds. On-chain, however, role holders can replace the vault's logic and pause it, so whoever holds the upgrade role has effective custody.

  Evidence

  • webhttps://zkblast.tech/
    Show source

    A SHIELDED VAULT WHERE A DEPOSIT BECOMES A PRIVATE NOTE ONLY YOU CAN PROVE YOU OWN. If you lose the note, the deposit cannot be recovered by anyone.

  • on-chainprivileges: upgradeToAndCall(address,bytes)
    Show source

    logic can be replaced at any time

  • webhttp://zkblast.tech/
    Show source

    Custody stays non-upgradeable where possible, and every proof is checked onchain against a registered verification key. ZKBlastVault.sol Custody, deposits, withdrawals, pause controls, asset allowlist

  • on-chainproxyType = uups; implementation = 0x229375Fb963b3EBEb8aa46aAfD5eAb31D497bA61
    Show source

    Upgradeable uups proxy: logic can be replaced at any time (implementation 0x229375Fb963b3EBEb8aa46aAfD5eAb31D497bA61)

  • on-chainupgradeToAndCall(address,bytes)
    Show source

    restrictedTo: unknown (unverified bytecode)

  • on-chaindeposit(address,uint256,bytes32) selector 0x26b3293f
    Show source

    access: unknown (unverified)

  • on-chainsetPaused(bool) selector 0x16c38b3c
    Show source

    Can pause / freeze all transfers

  • on-chainassetConfig(address) selector 0xd6dbaf58
    Show source

    access: unknown (unverified)

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol · Disputed by: gpt-5.6-sol

• MediumPosts say features are live; site shows zero pools and roadmap disagreesclaims-mismatchAI

  The public site still shows no validated pools, no markets, and an indexer that has not caught a block. The same project's X account says Dynamic Bonding Curve, launchpads, DLMM/DAMM, and private USDG swaps are already live on mainnet. Treat the 'already live' claims as unconfirmed until those transactions and the site's own pool board agree.

  Evidence

  • webhttp://zkblast.tech/
    Show source

    0 indexed
    Validated pool registry

  • webhttp://zkblast.tech/
    Show source

    0 validated markets
    Indexed block pending

  • Xhttps://x.com/zkblast9/status/2117735570977829087
    Show source

    Private USDG Swaps Demonstrated shielded transactions, private notes, and onchain settlement.

  • Xhttps://x.com/zkblast9/status/2117507950411644930
    Show source

    permissionless pools, live on HyperEVM

  Confirmed by: grok-4.7, gpt-5.6-sol

• LowWebsite domain registered the same day the vault was deployedwebsiteAI

  The contract was deployed on 2026-10-20 at 09:07 UTC. The zkblast.tech domain was registered about 4.5 hours later, and its first archive snapshot is also from 2026-10-20. The project is roughly two weeks old with no track record.

  Evidence

  • on-chaindeployedAt = 2026-10-20T09:07:20.000Z; deployer 0xB5C0eD0252d1906Fca50664Eb2198Aea0679920B
  • webhttp://zkblast.tech/

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol

• LowUnconfirmed X claims that the team rebranded a rugged projectdeployer-historyAI

  Several posts from @alphadegen69 claim ZKBLAST is the same team as QuantaPools, that Quanta already rugged, and that the advertised token will be rugged again. Another account replies that Quanta and ZKBLAST are two separate projects. No on-chain link between the deployer of the contract under review and a prior rug was found here, so this is an allegation, not a confirmed history.

  Evidence

  • Xhttps://x.com/alphadegen69/status/2118201210281058804
    Show source

    $Zkblast is same quanta team that rugged and rebranded to Zkblast

  • Xhttps://x.com/alphadegen69/status/2118097203952550124
    Show source

    @QuantaPools already rugged and launched same rebranded UI project as @zkblast9

  • Xhttps://x.com/sonofsun1984/status/2118154063011328286
    Show source

    Already 2 separate projects as you can see in quoted post

  Confirmed by: grok-4.7 · Disputed by: gpt-5.6-sol

Notes (4)

• LowDocs admit upgradeable proxies but do not name who holds the admin keywebsiteAI

  The docs tell integrators to use a proxy whose implementation can change after an approved upgrade, and the threat model includes governance or admin key compromise. The deployment list on that page was still 'Loading deployment manifests', so this review cannot see who holds that upgrade key or whether the contract under review is one of those proxies. Funds in an upgradeable vault can be redirected if that key is misused.

  Evidence

  • webhttp://zkblast.tech/docs
    Show source

    Use the proxy address for integrations and transactions. It remains stable across upgrades.

  • webhttp://zkblast.tech/docs
    Show source

    The implementation address identifies the currently deployed logic and can change after an approved upgrade.

  • webhttp://zkblast.tech/docs
    Show source

    Governance or admin key compromise

  • webhttp://zkblast.tech/docs
    Show source

    Loading deployment manifests…

  Confirmed by: grok-4.7, claude-opus-5.5, gpt-5.6-sol

• InfoX account is a week old and lists a different token addresssocialAI

  @zkblast9 was created on 2026-10-28, eight days after the site domain and this contract. Posts are all about ZKBLAST, so this does not look like an old renamed account. The bio's token CA is 0x3f9f…ecd7, not the contract under review (0xaac5…748a), which is not an ERC-20. No named person is identified; the FOMO post only says a team-tag application was submitted, not that a verified dev profile exists.

  Evidence

  • Xhttps://x.com/zkblast9/status/2117523321155907955
    Show source

    Team tag application submitted. Official fomo profile:

  • webhttp://zkblast.tech/
    Show source

    @zkblast9

  Confirmed by: grok-4.7

• InfoScanner bot coin stats refer to a token, not this vaultsocialAI

  LarpCheck scored a ZKBLAST coin (holders, launch dumps, privacy wording). The contract under review is not an ERC-20: it has no holder set, liquidity, or buy/sell tax, so those coin figures cannot be checked against it and should not be read as facts about this address. The bot's note that shielded use was not confirmed does match the site, which still shows no validated pools.

  Evidence

  • Xhttps://x.com/Larpcheckbot/status/2118170406565613957
    Show source

    Couldn't confirm yet: - Shielded vault use not confirmed

  • webhttp://zkblast.tech/
    Show source

    0 validated markets

  Confirmed by: grok-4.7, claude-opus-5.5, gpt-5.6-sol

• InfodApp swap test timed out after only a login signaturewebsiteAI

  Our scripted run of the site's swap page on a local fork only produced a standard SIWE login signature. No token approval or Permit was requested and no transaction was sent before the test hit its time cap, and the reverse-swap test was skipped. This is inconclusive: no harmful approval was seen, but the advertised swap was not shown to work.

  Evidence

  • forkdApp test 'Swap' step: personal_sign (SIWE login)
    Show source

    Sign in to ZKBLAST.

  • forkdApp test 'Swap' observed
    Show source

    wallet no balance change; 0 tx (none). No successful transaction was made for this goal (timeout).

  Confirmed by: claude-opus-5.5, grok-4.7, gpt-5.6-sol