Arbitrum

https://arbitrum.foundation · Published 19 Aug 2026

ChainSift Score / 100

RISK: MEDIUM

Arbitrum is a well-established Ethereum Layer 2 scaling solution operated by the Arbitrum Foundation, a Cayman Islands foundation company. The project has a large holder base (2.37M+) and verified on-chain contract, but the foundation website itself lacks dedicated pages for team, tokenomics, audits, and terms of service — much of this information is hosted across external properties (docs.arbitrum.io, governance.arbitrum.foundation) not retrieved in this audit. The upgradeable proxy contract and top-10 holder concentration of 48.6% represent the most material risks identified from on-chain data.

This report is published free of charge and stays published. It was produced because somebody paid for the investigation to happen — we never disclose who requested a report, and paying for one does not influence what it says.

What we could not check. These are gaps in our collection, not findings about the project. The affected sub-signals were excluded from the score and from the maximum — the project is not penalised for them.

The Terms of Service page linked from the site footer could not be confirmed as retrievable — the canonical /terms and /terms-of-service URLs returned 404, and the actual destination of the footer link was not fetched. Legal terms were only partially assessed.
External documentation sites (docs.arbitrum.io, governance.arbitrum.foundation) were not retrieved. Tokenomics, vesting schedules, audit reports, and technical documentation that may exist there were not assessed.
The Arbitrum GitHub repository (github.com/OffchainLabs) was not fetched. Repository activity was inferred from public knowledge of the project rather than direct retrieval.
No audit report URL was retrievable from the fetched pages. Security audits conducted by Trail of Bits and others are publicly known to exist for Arbitrum but were not linked from the retrieved site content and could not be confirmed or scored.
The footer references a Brand Kit and Research Forum — these were not fetched and may contain additional disclosures relevant to regulatory posture or team information.

On-chain contract data

ARB · Arbitrum · 0x912ce59144191c1204e64559fe8253a0e49e6548

Upgradeable proxy — logic can be replaced
Top-10 holders control 48.6% of supply
Contract source is verified on the explorer
Liquidity is NOT locked

These facts are read from the contract and override anything the project's own material claims. See the live on-chain check →

Scores by category

Team & Transparency 11/20

identities verifiable 5 · track record 4 · public presence 2

The arbitrum.foundation website does not publish a team page; the /team and /about-us URLs returned 404. No individual names or pseudonyms are listed on the retrieved pages.
The Arbitrum Foundation is publicly associated with Offchain Labs (founded by Ed Felten, Steven Goldfeder, and Harry Kalodner), whose identities are verifiable through independent academic and corporate sources — however, this information does not appear on the retrieved site content and could not be confirmed from the pages fetched.
The Foundation's mission and governance structure are described on the /about page, and Foundation Bylaws are referenced as a linkable document, indicating some institutional transparency beyond the team level.
Public governance participation via ArbitrumDAO and a governance forum is referenced, providing a channel for community accountability, though no specific team members' public engagement was observable from the retrieved pages.

Tokenomics 10/20

supply documented 1 · holder concentration 4 · unlocks disclosed 1 · token function 4

No tokenomics, supply schedule, or emission documentation was found on any retrieved page. The /tokenomics and /token URLs returned 404. Total supply and emission schedule are not documented on this site (they may exist on external docs sites not retrieved).
On-chain data shows top-10 holders control 48.6% of supply. With 2,371,541 holders, retail distribution is broad, but the heavy top-10 concentration — likely including foundation/DAO treasury addresses — represents a material concentration risk.
No vesting or unlock schedule was found on any retrieved page. The /docs, /whitepaper, and /documentation URLs all returned 404, leaving unlock disclosures unassessable from this site alone.
Token function is well-established: ARB is used for governance (voting, delegation) within ArbitrumDAO, as explicitly described on the homepage and /about page. This is a clear stated utility beyond speculation.
Liquidity locked at 0% per on-chain verification. For a governance token of this scale, this is expected (liquidity is not the primary use case), but it is noted for completeness.

Technology 13/20

source verified 4 · audit published 0 · repo activity 6 · stage matches claims 3

Contract source is verified on-chain (confirmed by retrieval facts). The contract at 0x912ce59144191c1204e64559fe8253a0e49e6548 on Arbitrum is source-verified. Full marks awarded for this sub-signal.
No audit page or audit link was found on the retrieved site. The /audit, /audits, and /security URLs all returned 404. A claimed audit with no retrievable link on this site scores 0 here. Audits may exist at external URLs (e.g., docs.arbitrum.io) not fetched in this review — see gaps.
Arbitrum is a live, production Layer 2 network with a large and active developer ecosystem. The homepage references developer documentation, an app portal, bridge, and research forum, consistent with an active, mature project. Repository activity at the Offchain Labs GitHub is publicly known to be substantial, though the GitHub was not directly retrieved in this audit.
The project is live and in production with millions of holders. The site's claims of scalability, security inheritance from Ethereum, and EVM compatibility are consistent with independently known facts about Arbitrum's deployed technology. However, the site does not document the current development roadmap or specific technical milestones, slightly limiting this score.
The contract is an upgradeable proxy. While this is architecturally appropriate for a complex Layer 2 system governed by a DAO, it does mean contract logic can be changed — a risk factor noted under contract mechanics.

Red Flags 16/20

contract mechanics 7 · copied content 4 · impossible claims 4 · manufactured activity 1

The contract is confirmed non-honeypot, with 0% buy/sell tax, no mint function, no pause function, and no blacklist. These are positive indicators. However, the contract is an upgradeable proxy, which means the contract logic is modifiable. In the context of a DAO-governed system this is a known and disclosed architecture, but it does represent a structural mechanism that can alter token behavior without redeployment.
No copied or lifted content was detected in the retrieved pages. The privacy notice and about page appear project-specific. No evidence of plagiarism from other projects was found.
No impossible claims, guaranteed returns, or risk-free yield language was identified in any retrieved page. The site's marketing language ('scalability', 'security', 'compatibility') is technically supportable and standard for L2 projects.
Holder count of 2,371,541 is consistent with Arbitrum's established market position and not suggestive of manufactured activity. However, the site links to Discord and Twitter/X community channels with no independently retrieved follower data available to assess engagement authenticity. Score reflects inability to fully assess rather than confirmed manipulation.
Liquidity locked at 0% is noted. For a governance token this is not necessarily a red flag, but it removes one layer of holder protection and is disclosed here for completeness.

Legal 14/20

entity disclosed 6 · jurisdiction 4 · terms and privacy 2 · regulatory posture 2

The Arbitrum Foundation is explicitly named as a Cayman Islands foundation company in the retrieved Privacy Notice ('The Arbitrum Foundation, a Cayman Islands foundation company'). Full marks for entity disclosure and jurisdiction — both are specific and independently checkable.
The Privacy Notice at arbitrum.foundation/privacy is substantive, project-specific, and up to date (last revised March 25, 2025). It covers data collection, use, cookies, and user rights under Cayman Islands Data Protection Act and EU GDPR. This is not generic boilerplate.
A Terms of Service is referenced in the footer of both the homepage and /about page, and is linked from the site. However, the /terms and /terms-of-service URLs returned 404, and the actual Terms of Service document was not retrieved in this audit. The Privacy Notice was retrieved successfully. Partial credit awarded for terms since the link exists in navigation but the destination page was not confirmed as retrievable.
No explicit regulatory disclosure, securities law disclaimer, or token classification statement was found in any retrieved page. Given that ARB is a governance token for a major DAO, the absence of any regulatory posture statement on the retrieved pages is a gap. This information may exist in the Terms of Service document that was not retrieved.

Key risks

Upgradeable proxy contract: the ARB token contract logic can be modified. While governed by the DAO, this mechanism represents a structural risk that token behavior could change post-deployment.
Top-10 holder concentration at 48.6%: a significant portion of supply is concentrated among a small number of addresses, likely including foundation and DAO treasury. Large coordinated movements from these addresses could have outsized market impact.
Tokenomics opacity on the retrieved site: supply schedule, emission plan, and unlock timelines are not documented on arbitrum.foundation. Investors relying solely on this site cannot independently verify distribution terms.
Audit inaccessibility from this site: no audit links were found on any retrieved page. While audits are known to exist for Arbitrum externally, the inability to surface them from the project's own foundation site reduces immediate verifiability.
Regulatory posture undisclosed: no statement on token classification or securities law compliance was found in the retrieved content. For a token of ARB's scale, absence of public regulatory disclosure is a gap for institutional due diligence.
Liquidity locked at 0%: while expected for a governance token, this means there are no contractual lock mechanisms protecting open-market liquidity.

Questions to ask before investing

Where are the security audit reports for the ARB token contract and Arbitrum protocol published, and who conducted them? Can links to the full reports be provided?
What is the full ARB token supply breakdown — how much is held by the foundation treasury, team, investors, and DAO, and what are the vesting and unlock schedules for each category?
What governance controls exist over the upgradeable proxy contract? Who holds upgrade keys, and what multi-sig or DAO approval process is required to execute an upgrade?
Can the Terms of Service document be confirmed accessible and its URL provided, given that /terms and /terms-of-service both return 404?
Has the Arbitrum Foundation obtained any legal opinions on the regulatory classification of ARB tokens in key jurisdictions (US, EU, UK)? Is that opinion publicly available?
Who are the current members of the Arbitrum Foundation's board or governing council, and are their identities and roles publicly disclosed?

Scored by the published ChainSift methodology: five categories of 20 points each. Sub-signal scores are summed by code, not chosen by a language model. This is risk assessment, not investment advice, and it describes what was observable on the date shown. Projects change.