TL;DR
Monad Cards is a real, well-built contract on Monad — no rug switch, no exploitable bug we could find. Claiming is safe: you receive a soulbound card, you don't approve any spending, so there's no drain risk from the mint itself.
Two things worth knowing: (1) the cards are soulbound — you can't sell or transfer them, they're a reputation mark, not a tradeable asset; (2) despite the "Fully On-Chain" label, the artwork traits are served from Monad's server and can change — the image lives on IPFS, but the metadata does not.
The single biggest risk to you isn't the contract — it's fake lookalike sites. Only ever claim at cards.monad.xyz.
What it is the basics
| Contract | 0x0000CA12D5c07085022eBC74867157449919Fd67 |
| Name / Symbol | Monad Cards · CARDS |
| Standard | ERC-721, soulbound (non-transferable) |
| Chain | Monad mainnet (chain id 143) |
| Upgradeable? | No — not a proxy. The code can't be swapped out from under holders. |
| Owner | A Gnosis Safe multisig (not a single hot wallet), with two-step ownership transfer |
| How you get one | Gated mint — a Merkle allowlist + an EIP-712 signature, one per address, unlocked by linking your X (Twitter) account on the official site |
What's solid the good news
These are the things we checked and they hold up.
Soulbound is real, enforced on-chain
The metadata says "soulbound," and the contract actually backs it up. We simulated a transfer of a live card and it reverts — these cards genuinely can't be moved, sold, or stolen. It's a reputation badge, not a flippable JPEG.
Not upgradeable — no hidden rug switch
The contract is a plain deployment, not a proxy. There's no admin "upgrade" button to quietly replace the logic and drain or re-mint. What's deployed is what you get.
Owner is a multisig, not one key
The owner address is a Gnosis Safe (a multi-signature wallet), and ownership uses a safer two-step handover. A single leaked key doesn't hand the contract to an attacker.
Minting is gated and one-per-address
You can't forge your way to a card. Eligibility is enforced by a Merkle root stored on-chain plus a signed authorization, and a per-address isClaimed flag stops double-claims.
Honest caveats what to understand
Nothing here is exploitable, but you should know how it really works.
"Fully On-Chain" is a stretch — traits are server-controlled
The site shows a "Metadata: Fully On-Chain" badge, but the token's tokenURI actually points to https://cards.monad.xyz/api/metadata/… — a normal web server. The name, description and rarity traits (Wave, Mint Grade, Card Guard) come from Monad's backend and can be changed. The artwork itself is pinned on IPFS and is immutable; the trait sheet around it is not.
A backend key decides who mints and with what traits
Because minting relies on a signature from Monad's server, whoever holds that signer key effectively controls issuance and rarity. That's normal for a curated community drop, and it isn't exploitable from the outside — but it means the collection's "rarity" is a decision, not a trustless dice roll.
Zero market value — by design
Since cards can't be transferred, there's no secondary market and no floor price. If you were hoping to sell your airdropped card, you can't. That's the point: it's a token of appreciation, not a payday.
Is it safe to claim? the practical bit
The real danger is off-chain: fake sites that copy the look of Monad Cards to get you to "connect" or "claim," then drain you. Protect yourself:
Only ever claim at cards.monad.xyz — check the URL letter by letter.
Never sign a transaction to claim on any other domain, and be suspicious of any "Monad Cards" site that asks you to approve tokens — a legit claim never needs that.
How we checked receipts
Everything above is from reading the live contract on Monad mainnet — anyone can reproduce it.
eth_call safeTransferFrom(holder, 0x…dead, #568) → execution reverted (0xa4420a95)
# not a proxy — EIP-1967 implementation & admin slots are empty
storage[impl] → 0x000…000 storage[admin] → 0x000…000
# metadata is a web URL, not on-chain
tokenURI(568) → https://cards.monad.xyz/api/metadata/568
# gated mint primitives present in the bytecode
merkleRoots(uint256) · addRoot(bytes32) · isClaimed(address) · eip712Domain() · InvalidSignature()