Wrapped BTC (WBTC) security report
WBTC on Base (0x1ceA8420...) security review: non-upgradeable 0.4.24 token, no fees; medium risks from owner minting and pausing.
Standard and non-upgradeable, but centrally controlled: the owner can mint unlimited WBTC and pause all transfers, so safety depends on the WBTC custodians and their key management. No critical or high issues were found; the 'fake token' provider label is a false positive.
Trust score: 79/100. Source verified: Yes. Chain: base. Contract: 0x1cea84203673764244e05693e42e6ace62be9ba5.
This report was last modified on 2026-10-20 and contains 2 material findings.
medium finding: Owner can mint unlimited WBTC; minting can never be finished
mint() is restricted to the owner but has no supply cap, and WrappedToken overrides finishMinting() to always return false, so minting stays open permanently. The 1:1 BTC backing is enforced off-chain by the custodian process, not by this contract. If the owner key or owner contract were compromised, unbacked WBTC could be minted on Base without limit, diluting holders.
Evidence: [E09] https://github.com/WrappedBTC/bitcoin-token-smart-contracts/blob/master/evm-base-contracts/contracts/token/WrappedToken.sol#L11-L25: WrappedToken: inherits StandardToken, MintableToken, BurnableToken, PausableToken, OwnableContract. Overrides: burn(uint) onlyOwner (L14), finishMinting() onlyOwner returns false - minting can never be finished (L18), renounceOwnership() reverts (L22). [E11] https://registry.npmjs.org/openzeppelin-solidity/-/openzeppelin-solidity-1.12.0.tgz: OpenZeppelin 1.12.0 (version pinned in evm-base-contracts/package.json). Relevant code: MintableToken.mint L35-L49 (hasMintPermission = owner only, no cap, canMint); Pausable.pause/unpause L37-L49 (onlyOwner); PausableToken adds whenNotPaused to transfer, transferFrom, approve, increase/decreaseApproval; BasicToken.transfer L31 (no fee, rejects zero address, SafeMath); StandardToken.transferFrom L25; Claimable L27-L38; CanReclaimToken.reclaimToken L21. sha256 is of the npm tarball. [E13] test_wbtc.sh (27 cases): Behavioural test script run 2026-10-16: E08-E11 compiled with solc 0.4.24+commit.e67f0147 --optimize, deployed on anvil (Foundry 1.5.1) and exercised with cast. 27/27 passed: metadata (8 decimals), owner-only mint with no cap, finishMinting no-op, fee-free transfers, zero-address and balance checks, allowance accounting, holders cannot burn / owner burns own balance, owner-only pause, transfers and approvals revert while paused, owner can mint while paused, unpause, renounceOwnership blocked, owner-only reclaimToken, two-step ownership. [E04] https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x1cea84203673764244e05693e42e6ace62be9ba5: GoPlus token_security API snapshot for Base (chain 8453), retrieved 2026-10-12. Automated provider data, not a security review: is_mintable=1, transfer_pausable=1, fake_token={value: 1, true_token_address: 0x0555e30da8f98308edb960aa94c0db47230d2b9c}; the fake_token label contradicts the official WBTC contract-addresses page, which lists this address as native WBTC on Base. Radar re-runs provider checks live before publication.
Recommendation: Keep ownership with an audited Controller/multisig as on Ethereum; publish the Base owner address and custody proof-of-reserves for Base supply. Before approval, read owner() on BaseScan and record whether it is a contract (Controller) or an EOA.
medium finding: Owner can pause all transfers and approvals
pause() (owner-only) sets paused=true, after which transfer, transferFrom, approve, increaseApproval and decreaseApproval revert for every holder until the owner calls unpause(). There is no time limit. The owner can still mint while paused. Holders therefore rely on the owner not to freeze the token indefinitely.
Evidence: [E11] https://registry.npmjs.org/openzeppelin-solidity/-/openzeppelin-solidity-1.12.0.tgz: OpenZeppelin 1.12.0 (version pinned in evm-base-contracts/package.json). Relevant code: MintableToken.mint L35-L49 (hasMintPermission = owner only, no cap, canMint); Pausable.pause/unpause L37-L49 (onlyOwner); PausableToken adds whenNotPaused to transfer, transferFrom, approve, increase/decreaseApproval; BasicToken.transfer L31 (no fee, rejects zero address, SafeMath); StandardToken.transferFrom L25; Claimable L27-L38; CanReclaimToken.reclaimToken L21. sha256 is of the npm tarball. [E13] test_wbtc.sh (27 cases): Behavioural test script run 2026-10-16: E08-E11 compiled with solc 0.4.24+commit.e67f0147 --optimize, deployed on anvil (Foundry 1.5.1) and exercised with cast. 27/27 passed: metadata (8 decimals), owner-only mint with no cap, finishMinting no-op, fee-free transfers, zero-address and balance checks, allowance accounting, holders cannot burn / owner burns own balance, owner-only pause, transfers and approvals revert while paused, owner can mint while paused, unpause, renounceOwnership blocked, owner-only reclaimToken, two-step ownership. [E04] https://api.gopluslabs.io/api/v1/token_security/8453?contract_addresses=0x1cea84203673764244e05693e42e6ace62be9ba5: GoPlus token_security API snapshot for Base (chain 8453), retrieved 2026-10-12. Automated provider data, not a security review: is_mintable=1, transfer_pausable=1, fake_token={value: 1, true_token_address: 0x0555e30da8f98308edb960aa94c0db47230d2b9c}; the fake_token label contradicts the official WBTC contract-addresses page, which lists this address as native WBTC on Base. Radar re-runs provider checks live before publication.
Recommendation: Document the pause policy and keep pause authority behind a multisig/timelock. Before approval, check paused() on BaseScan is false.