Security is one of the most important aspects of any blockchain platform, particularly when smart contracts are responsible for managing user funds, token launches, presales, and liquidity.
Unlike traditional software, smart contracts execute transactions directly on the blockchain. Vulnerabilities can have serious consequences, which is why thorough testing and security reviews are essential.
As part of its ongoing efforts to improve security and transparency, the Token Forge team has completed a comprehensive Smart Contract Security Review, covering the platform's core infrastructure and the broader Token Forge ecosystem.
The complete technical report is available to the public, including all identified findings, testing methods, and recommendations.
Why Conduct an AI-Assisted Security Review?
Professional smart contract audits are an important part of blockchain security, but comprehensive third-party audits can also be extremely expensive, particularly for platforms with large and complex smart contract systems.
Token Forge consists of numerous interconnected contracts responsible for different parts of the token launch process. A thorough external audit of this infrastructure represents a significant financial commitment.
While commissioning an independent third-party audit remains a long-term goal, the team decided not to simply wait until the necessary budget becomes available.
Instead, it conducted an extensive internal security assessment using multiple independent AI reviewers, supported by automated testing, blockchain simulations, and manual verification of the results.
This approach allows the project to identify potential weaknesses, evaluate existing security mechanisms, and document areas for improvement while continuing to work toward an external audit.
Importantly, this review is not presented as an independent security audit or a replacement for one. It is an additional security assessment conducted by the Token Forge team with AI assistance.
What Was Reviewed?
The assessment covered more than 9,000 lines of Solidity code across the Token Forge and PBTC ecosystem.
The reviewed components include:
Token creation and launch infrastructure: The contracts responsible for deploying new tokens, configuring their features, and completing launches.
Presale mechanisms: Fixed Price, Stepped Price, and Bonding Curve presales, including purchasing, selling, refunds, and launch conditions.
Liquidity management: Automatic Uniswap V3 liquidity creation, liquidity locking, and trading fee management.
Staking and vesting: The staking contracts for launched tokens, team token vesting, and the PBTC staking system that distributes COAL rewards.
Price oracles: The mechanisms used to calculate PBTC, COAL, and ETH prices for fees, presales, and other platform operations.
Administrative controls: The permissions and upgrade mechanisms used to maintain and manage the platform's infrastructure.
The review examined how these systems function individually and how they interact with one another.
Beyond reviewing the source code, the assessment included tests simulating real blockchain conditions using a local copy of Base mainnet.
The documented testing included 114 local tests, 22 mainnet-fork tests, and 46 additional reviewer proofs of concept, including 11 conducted on a mainnet fork.
These tests helped examine contract behavior, fund movements, launch procedures, and potential failure scenarios.
Security Review Results
The review identified the following findings:
Severity | Findings |
|---|---|
Critical | 0 |
High | 0 |
Medium | 2 |
Low | 3 |
Informational | 9 |
No Critical or High severity vulnerabilities were identified during the assessment.
The reviewers also did not identify a vulnerability that would allow an external attacker to directly steal user funds under the reviewed conditions.
However, the assessment did identify areas that deserve attention, particularly regarding administrative permissions and the liquidity supporting the platform's price calculations.
These findings are documented in the report rather than being excluded or downplayed.
Understanding the Main Findings
Two findings were classified as Medium severity.
1. Administrative Upgrade Permissions
Token Forge uses multisignature wallets to control important administrative operations, including upgrades to certain smart contracts.
Although these wallets require multiple authorized signatures, some sensitive changes can currently be executed without a mandatory waiting period.
The review recommends introducing additional safeguards, such as a timelock, which would create a delay before certain administrative changes become effective.
This would provide additional transparency and time to react to unexpected or unauthorized changes.
2. Price Oracle and Liquidity Depth
Token Forge uses blockchain liquidity pools to calculate token prices. These prices are used for functions such as token creation fees, presale conditions, and liquidity management.
The review found that the current PBTC/USDC liquidity pool is relatively small, making its price more susceptible to temporary manipulation.
Although the system uses time-weighted average pricing to reduce the impact of short-term price fluctuations, the review demonstrated that this protection has limitations when liquidity is low.
The recommendations include increasing liquidity and introducing additional protections for operations that depend on these prices.
The remaining Low and Informational findings describe smaller design limitations, unusual operating conditions, and opportunities to improve the system further.
What Does This Mean for Token Forge Users?
The results provide useful insight into the platform's current security design and the areas where improvements can be made.
The assessment examined important mechanisms intended to protect participants, including presale refunds, liquidity locks, token supply restrictions, and the handling of funds throughout the token launch process.
Testing also covered scenarios such as unsuccessful presales, unexpected liquidity pool conditions, and smart contract upgrades.
While these results are encouraging, no security review can guarantee that a smart contract system is free of vulnerabilities.
AI-assisted reviews have limitations, and testing cannot account for every possible scenario or future change in market conditions.
For this reason, the Token Forge team considers the review an additional layer of security evaluation, not a final certification of the platform.
Continuing to Improve Security and Transparency
Publishing the complete report is intended to give users, token creators, and technically interested community members a clearer understanding of how Token Forge operates and where potential risks remain.
The report includes the review methodology, detailed technical findings, supporting test results, current administrative configuration, and recommended improvements.
The team will use these findings to guide further development and security improvements, with particular attention to administrative safeguards and oracle reliability.
An independent third-party audit remains an important future objective when the project's financial resources allow it.
Until then, ongoing testing, code reviews, transparent documentation, and continuous improvements remain central to the development of Token Forge.
Read the Complete Security Review
The full Token Forge Smart Contract Security Review, dated November 13, 2026, is available as a PDF.
It contains the complete technical analysis, all 14 findings and observations, testing methodology, supporting evidence, and recommendations.