What is actually true of the deployed contracts
Each line was checked directly against Base mainnet, or executed against a fork of it, on the date above — not copied from the audit summary.
- The token cannot be upgraded. It is deployed directly, not behind a proxy. What runs today runs permanently.
- No address can be blacklisted. The contract checks a blacklist on every transfer, but contains no function that can write to it. Scanners that flag this are flagging unreachable code.
- The 1% transfer tax cannot be raised. It is a compile-time constant in a contract that cannot be upgraded.
- The 35/35/10/20 split is hardcoded in the voting contract and enforced on every settlement.
- Chainlink VRF picks the winner. Subscription and coordinator are public and verifiable.
- Liquidity is locked on Team.Finance until 2027-05-05.
- Supply is governed, not fixed. A
mint()function exists. MINTER_ROLE has no members today, but the 2-of-2 multisig holds DEFAULT_ADMIN_ROLE and can grant it to itself. We tested this on a mainnet fork and successfully minted. Treat 69,000,000,000 as the current supply, not a cap. - A transfer of exactly zero tokens reverts between two non-tax-exempt addresses, with an arithmetic panic rather than a clean error. This is an ERC-20 compliance defect. A fix was written and deployed as a separate contract, but it never took effect because the token is not upgradeable.
- The voting contract has an accepted reentrancy finding in
vote(). It is not exploitable: $TTS is a plain ERC-20 with no transfer hooks and its address is immutable in the voting contract. Recorded as AF-001.
Anything not on this list has not been independently verified. If you are evaluating this project, read the contracts on BaseScan rather than trusting this page.
Full Report — Solidproof
📄 Published at Solidproof
The full audit report is publicly available at app.solidproof.io/projects/temptation-token. All findings, code snippets, severity ratings, and auditor commentary are included.
Auditor: Solidproof GmbH (Germany) · Audit Date: April 2026 · Methodology: Manual review + automated analysis
Contracts Audited
| Contract | Address | Network | Status |
|---|---|---|---|
| TTS Token (ERC-20 UUPS Proxy) | 0x5570eA…3b9 | Base Mainnet | ✓ Audited |
| TTSVotingV3d (Active) | 0x783b…7b4 | Base Mainnet | ✓ Audited |
| TTSStaking (UUPS Proxy) | 0x7848…c0d | Base Mainnet | Source-verified · deployed after audit |
Solidity version: 0.8.20 · Standards: ERC-20, EIP-1967 (UUPS) · Chain ID: 8453
All Findings by Severity
| ID | Severity | Title | Status |
|---|---|---|---|
| M-1 | Medium | ERC-20 Zero-Value Transfer Tax Issue | Acknowledged ✓ |
| M-2 | Medium | Centralization Risk — Wallet Address Updatability | Acknowledged ✓ |
| M-3 | Medium | Integer Division Rounding in Prize Distribution | Acknowledged ✓ |
The audit raised 1 critical, 3 high, 7 medium and 6 low findings against TTSVoting. C-1 and H-1–H-3 were fixed in V3b, along with M-2, M-3 and M-6. M-1, M-4 and M-7 were acknowledged and not patched; M-5 is recorded as accepted and non-exploitable (a reentrancy pattern that requires a token with transfer hooks — $TTS has none and its address is immutable). On the token, the zero-value-transfer finding was fixed in implementation 0xb995b63c. See the full SolidProof report for the complete text.
Medium Findings — Click to Expand
M-1: ERC-20 Zero-Value Transfer
Acknowledged ✓transfer() and transferFrom() functions apply tax logic even when amount == 0. EIP-20 requires zero-value transfers to succeed without side effects. A fix adding if (amount == 0) return true before tax logic is queued for the next UUPS proxy upgrade through the Gnosis Safe 2/2 multisig. This issue poses no risk to user funds.
M-2: Centralization Risk
Acknowledged ✓M-3: Prize Distribution Rounding
Acknowledged ✓All Contract Addresses — Copy & Verify
Every address below is publicly verifiable on BaseScan. Click copy to get the full address.
TTS Token (UUPS Proxy) — The main $TTS token contract
TTSVotingV3b — Active voting contract (FINAL)
Gnosis Safe — 2/2 multisig treasury
See for yourself — every transaction is on-chain and verifiable at basescan.org