Security

Security and contract verification

“Audited”, “verified” and “secure” are claims. This page states what each one means on Elevate, what evidence exists for it, and what you can check yourself before you sign anything.

How contracts are reviewed

Every collection on Elevate deploys through the same ERC-721A launchpad contract, built on OpenZeppelin components. Before a collection is listed, its configuration — phases, wallet limits, royalty settings, reveal plan and transfer lock — is reviewed against what the creator has published, and the deployed address is confirmed on the explorer. After deployment the collection page reads its numbers from that contract, so a reviewed configuration cannot drift from what collectors see.

Criteria: what Elevate verifies. Technical detail: security documentation.

Audits

An audit claim is only worth the report behind it. This registry lists audits by collection, with auditor, scope, date and a link to the report.

Audit registry

No third-party audit report is published here yet. Until one is, Elevate describes its contracts as reviewed and security-tested — built on OpenZeppelin's audited libraries, with the controls listed below — rather than as independently audited. When a report is published it will appear in this table with the auditor, scope, contract version and a link.

OpenZeppelin foundations and contract controls

  • OpenZeppelin foundations

    Access control, pausability and reentrancy protection come from OpenZeppelin's audited libraries rather than bespoke code.

  • Reentrancy protection

    Every state-changing entry point is guarded, so a malicious receiver contract cannot re-enter the mint.

  • Emergency pause

    The owner can pause minting if something goes wrong. Pausing does not move or burn anyone's tokens.

  • Hardcoded caps

    The maximum marketplace fee is fixed in the contract and cannot be raised after deployment.

  • Input validation

    Quantity, phase, payment and signature inputs are validated on every public function.

  • Scoped owner role

    The owner can pause, update fees within the cap, change fee recipients and configure phases before they start. The owner cannot mint outside the rules, seize tokens or change a phase that has already begun.

Source: OpenZeppelin Contracts . In depth: smart-contract security.

Access control

What the contract owner can and cannot do.

Can

  • Pause and unpause minting
  • Configure phases before they start
  • Update fees within the hardcoded cap
  • Change fee recipients
  • Unlock transfers (one-way)
  • Reveal and freeze metadata

Cannot

  • Mint outside the phase rules
  • Change a phase after it has started
  • Raise the marketplace fee cap
  • Seize or burn a holder's tokens
  • Re-lock transfers after unlocking
  • Change metadata after a freeze

Allowlist signatures, private keys and the platform

  • No custody

    Minting, buying and selling are transactions signed by your wallet. The site cannot initiate a transaction for you.

  • No private keys server-side

    The backend never stores user private keys. The only key it holds is the allowlist signer, which can approve a mint but cannot move funds or tokens.

  • Bound allowlist signatures

    Allowlist approvals are signed per wallet and per phase, so a signature cannot be reused by another wallet or in another phase.

  • On-chain re-validation

    Everything the site checks before you sign -- phase, allowance, balance -- is checked again by the contract, so a bug in the site cannot mint outside the contract's rules.

Verify a collection contract yourself

Every collection page shows its contract address. This takes a minute and is the single most useful thing you can do.
  1. 01

    Start from the collection page

    Open the collection on elevateart.xyz and copy the contract address shown under Contract. Never take an address from a DM, a reply or a QR code.

  2. 02

    Open it on the explorer

    Paste the address into https://evm.taostats.io. The page should show a deployed contract on chain ID 964 with mint transactions and a token count that matches the collection page.

  3. 03

    Check the name

    Elevate contracts are named after their collection so the explorer name should match the collection name, not a generic token name.

  4. 04

    Compare the numbers

    The total minted on the explorer should agree with the collection page, which reads the same contract. If the two disagree, stop and ask on the official Discord.

  5. 05

    Confirm the domain

    You should be on https://elevateart.xyz -- no other domain, subdomain or look-alike. The official links page lists every channel Elevate operates.

Full walkthrough with screenshots of what to expect: how to verify an NFT contract.

User safety

  • Avoiding NFT scams

    Fake mints, look-alike domains, DMs and malicious signatures — and how to spot each.

  • Official links

    Every channel Elevate operates. If it is not on this list, it is not Elevate.

  • Wallet privacy

    Connecting a wallet shares your public address only. Elevate stores wallet addresses and on-platform transaction history as described in the privacy policy.

Risk disclaimer

Contracts are reviewed and security-tested, but no blockchain platform can promise that funds are entirely safe. Always verify the contract address on the collection page against the Taostats EVM explorer before signing, check that your wallet is on Bittensor EVM (chain ID 964), and never share your seed phrase with anyone -- including anyone claiming to be from Elevate.

Report a suspected vulnerability privately to a team member on the official Discord, not in a public channel.

See it on a real collection

Open any collection page, copy the contract address and check it on the explorer.

View collectionsWhat Elevate verifies