Security · Audits · Contracts

Security & Smart Contracts

Five Pillars (5PT) is a non-custodial staking protocol on BNB Smart Chain. This page documents the audited contracts, the on-chain administrative model, and exactly how the protocol does — and does not — interact with your wallet. Every address and figure here can be verified on-chain; please do so before relying on anything.

Independent audits

The smart contracts have been reviewed by three independent security firms:

  • Cyberscope (reported score ~95%)
  • BailSec
  • SolidProof (reported score 89.20)

Audits reduce risk but do not eliminate it. They are a point-in-time review, they do not remove the single-owner centralization risk described below, and they are not a guarantee of safety or of returns. Read the reports in full before depositing. Audit reports.

On-chain contracts (BNB Smart Chain)

Total supply is dynamic — currently ~91.3 billion 5PT, not a fixed 100 billion. A Manager role can mint and burn within on-chain limits, and permanent burns reduce supply over time. Always confirm the live total and circulating supply on BscScan.

Administrative model & centralization risk

  • Ownership uses an Ownable2Step pattern. The owner account is 0x283e7D0AA6214fc4bdc8211fbe63c7B524E5E108 and ownership has not been renounced. Verified on-chain, the owner's only authority is transferring ownership: calling mint() as the owner reverts with OnlyInvestmentManager(), and setInvestmentManager() reverts with ManagerAlreadySetted() — the owner can neither mint tokens nor replace the manager.
  • Mint and burn are restricted to a single, source-verified InvestmentManager contract (0xE56E24748407A2A29183A90040Ac5E018D9ea5aA) — the only authorized caller. There is no owner or public mint path.
  • Deposit and claim actions carry a fee of up to 10%, capped in the contract (a hard MAX_FEE ceiling). Network gas fees also apply.
  • Independent token scanners corroborate this: GoPlus reports the token as non-pausable with no owner/public mint backdoor (is_mintable: 0, pausable: 0), and honeypot.is returned 0% tax with passing sell simulations at the time of testing. Re-check both before relying on them.

Administrative control is therefore narrower than a typical owner-controlled token — the owner cannot mint, pause, or seize, and the manager contract is fixed. The residual centralization consideration is that ownership is not renounced (the owner key could transfer control) and the InvestmentManager holds mint/burn authority within its coded limits. Understand this before depositing.

How the dApp interacts with your wallet

Five Pillars is non-custodial — the website never takes custody of your funds. You interact only with the audited InvestmentManager contract via standard, transparent deposit and claim functions, and every state-changing action is an explicit transaction you confirm in your own wallet. The dApp does not:

  • request blanket token approval to an unknown externally-owned account, or use setApprovalForAll over your assets;
  • ask you to sign Permit / Permit2 / eth_sign messages that move funds out of your wallet;
  • sweep your native BNB or unrelated ERC-20 / NFT assets.

Token approvals are scoped to the protocol's own contract for the staking token only. None of the wallet-drainer signing patterns above are used anywhere on this site.

At the token level, as audited: the 5PT token charges 0% buy / 0% sell / 0% transfer tax (distinct from the up-to-10% protocol deposit/claim fee above), and the contract contains no honeypot, blacklist, pause, or seize functions — there is no on-chain mechanism to freeze, blacklist, or claw back tokens already in your wallet. Holders can sell; an independent honeypot simulation (honeypot.is) returned 0% tax and passed its sell-path checks at the time of testing. Re-run it yourself before relying on it.

Taken together — 0/0/0% token tax, no honeypot/blacklist/pause/seize functions as audited, a ~10-year UNCX liquidity lock, and a deployer address separate from the owner — these are on-chain facts you can independently verify. None of them removes the single-owner centralization risk disclosed above, which remains.

Operator

The protocol is operated by Digital Operations Group LLC, Charlestown, Nevis, West Indies. Security contact: support@five-pillars.tech.

Verify & resources

Verify any address and figure on-chain before relying on it. Reward rates are set on-chain and not guaranteed to remain unchanged. Crypto assets are volatile — you may lose all capital. Not financial advice. Risk disclosure.